Basking: sign in with Authentik only, pages that nest and link

Sign-in is now OpenID Connect against Authentik (authorization code flow
with PKCE, state and nonce). The password, API tokens and the add command
are gone; each person who signs in gets a private notebook in a folder
named from a hash of who they are. An optional allowed list is checked on
every request.

Notes become pages with titles, a tree of subpages, [[links]] with
backlinks that follow renames, a Ctrl+K finder, slash commands, list
continuation, and Write and Read modes. Autosave keeps the text through a
dropped connection or an expired session. Export opens as an Obsidian vault.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/web/static/index.html

@@ -10,6 +10,9 @@
 </head>
 <body>
 <div id="app"></div>
+<script src="toolkit.js"></script>
+<script src="markdown.js"></script>
+<script src="editor.js"></script>
 <script src="app.js"></script>
 </body>
 </html>