One login for every Krakstack app.

This service owns user sessions, credentials, OAuth clients, and OIDC metadata. Other apps should redirect here instead of implementing their own auth stack.