Add member accounts: invites, registration, login, sessions, ban

Step 2 of the build order. The admin mints an invite link, the recipient
registers with it, and from then on has a session.

- The invite is spent in the same transaction that creates the account, so a
  failed signup leaves the code usable
- Sessions are idle timeouts, 24h or 30 days with remember me, read from a
  cookie or a bearer header, extended at most once a minute
- Ban is a reversible toggle that drops the member's live sessions
- No password minimum; login is rate limited instead, 10 failures per email
  in 15 minutes, cleared by a correct password
- Invite codes render as links carrying ?code=, which the register form
  prefills; PUBLIC_URL makes them pasteable from the loopback admin panel

Tests cover invite spending, the idle timeout, ban, and the rate limiter.

templates/admin.html

@@ -0,0 +1,56 @@
+{{define "content"}}
+<h1>Ylläpito</h1>
+
+<section>
+  <h2>Kutsut</h2>
+  <form method="post" action="/admin/invites"><button type="submit">Luo kutsukoodi</button></form>
+  <table>
+    <thead><tr><th>Kutsulinkki</th><th>Tila</th><th>Luotu</th></tr></thead>
+    <tbody>
+      {{range .Data.Invites}}
+        <tr>
+          <td>
+            {{if .IsValid}}
+              <a href="{{.Link}}" class="invite">{{.Link}}</a>
+            {{else}}
+              <code class="muted">{{.Code}}</code>
+            {{end}}
+          </td>
+          <td>{{if .IsValid}}käyttämätön{{else}}käytetty{{end}}</td>
+          <td>{{fidate .CreatedAt}}</td>
+        </tr>
+      {{else}}
+        <tr><td colspan="3" class="muted">Ei kutsuja.</td></tr>
+      {{end}}
+    </tbody>
+  </table>
+  <p class="muted">Lähetä linkki kaverille — se avaa liittymislomakkeen koodi valmiiksi täytettynä.</p>
+</section>
+
+<section>
+  <h2>Jäsenet</h2>
+  <table>
+    <thead><tr><th>Nimi</th><th>Sähköposti</th><th>Liittyi</th><th>Toiminnot</th></tr></thead>
+    <tbody>
+      {{range .Data.Members}}
+        <tr{{if .Banned}} class="banned"{{end}}>
+          <td>{{.Name}}{{if .Banned}} <span class="tag">estetty</span>{{end}}</td>
+          <td>{{.Email}}</td>
+          <td>{{fidate .CreatedAt}}</td>
+          <td class="actions">
+            <form method="post" action="/admin/users/{{.ID}}/ban">
+              <button type="submit">{{if .Banned}}Poista esto{{else}}Estä{{end}}</button>
+            </form>
+            <form method="post" action="/admin/users/{{.ID}}/password">
+              <input type="password" name="password" placeholder="uusi salasana" required>
+              <button type="submit">Vaihda salasana</button>
+            </form>
+          </td>
+        </tr>
+      {{else}}
+        <tr><td colspan="4" class="muted">Ei jäseniä. Luo kutsukoodi ja lähetä se jollekulle.</td></tr>
+      {{end}}
+    </tbody>
+  </table>
+</section>
+{{end}}