Add a session/identity port so authentication is pluggable

[devarshishimpi]

Why

Identity is currently fused to one specific mechanism: sessions are opaque tokens written to APP_KV in src/server/core/sessions.ts, the only login path is GitHub OAuth in src/server/routes/auth.ts and src/server/core/github/oauth.ts, and the guard in src/server/middleware/auth.ts reads that specific cookie shape. DashboardSessionUser in src/server/env.ts is defined in terms of GitHub fields, which then leak into account handling (src/server/db/accounts.ts keys off github_user_id).

Scope

• Define a session-store port (create/read/destroy/renew) and an identity-provider port (begin authorization, complete authorization, return a normalized identity) in packages/core/src/ports.
• Keep the KV-backed session store (now living in apps/worker after the platform-port issue) and GitHub OAuth (now in packages/provider-github after the git-provider issue) as the default implementations, same cookie name, TTL and semantics as today, no change for existing deployments.
• Make the session record's identity fields provider-neutral, with GitHub specifics carried as adapter-supplied metadata rather than core columns. Before implementing, open a short design note in this issue's thread describing the migration path for the existing github_user_id keying in packages/db's accounts module, this is the one part of the whole restructuring that is not a pure code move.
• Preserve the CSRF protections in packages/api's csrf middleware and the cookie flags (httpOnly, sameSite, secure) exactly.
• Add an in-memory session store and a fake identity provider in packages/core/test/fakes so auth-related tests in test/api can run without any network access.

Acceptance criteria

• Middleware and routes depend on the session-store and identity-provider ports, not on KV or GitHub OAuth directly.
• Existing sessions continue to work across the deploy, document the compatibility strategy in the PR description.
• Auth-related tests run with no external service.
• Security review passes: no widening of cookie scope, no token ever logged (the scrubbing in packages/core's logger still applies).