[juancobo]

Adds sign-in by emailed link to the shared sign-in at ampl.tools/auth, alongside GitHub.

• Accounts can exist without GitHub. githubId on the shared user record may be null; tools that read it must handle that.
• Link requests are limited to allowed domains, rate-limited, and gated by Turnstile, with the token's hostname and action checked server-side.
• Sign-in mail is sent from a dedicated entrypoint on the email Worker.
• safeReturnTo rejects a return path that normalizes to another origin.
• Sign-out and other form posts are refused unless same-origin.
• The theme gains application color tokens.

Migration. 0002_email_login rebuilds users and sessions (nullable github_id, unique email) and adds email_login_tokens. It is forward-only: D1 has no rollback, and an earlier Worker version cannot run against the new schema once email-only accounts exist. It refuses to run if two accounts share an email address.