auth: sign-in ways, sign-in mode, and the admin who keeps a password (S1)

Spec 12 S1: migration 0012 (password_hash nullable, user_identities, sessions.method and the
OpenID token columns), auth.mode (only "password" until S2), GET /api/auth/methods, login body
{login, password} (email still accepted), signIn on users and /api/auth/me, a Signs in with
column on Users. The last active admin with a password can't be deleted, disabled or demoted.

docs/spec/04-backend-api.md

@@ -36,6 +36,11 @@
 - Login rate limit: 5 failures per IP per 15 min and 10 per email per hour → HTTP 429.
   Write `login_failed` to the audit log with the IP.
 - If `must_change_password`, every route except `/api/auth/*` returns 403 `{code:'password_change_required'}`.
+- Single sign-on (spec 12, as built in S1): the body is `{login, password, totp?}` (`login`: email, or a
+  directory username from S4; `email` is still accepted). A user without a password fails like a wrong
+  one. `auth.mode = 'oidc'` refuses passwords for non-admins (403 `password_sign_in_off`).
+  `GET /api/auth/methods` (public) → `{mode, ldap, oidc}` for the login page. The last active admin
+  **with a password** can't be deleted, disabled or demoted.
 
 ### 2.3 API tokens (integrations)
 - Header `Authorization: Bearer sp_<40 random base62 chars>`. Stored as sha256.