Sign in with Autheory staff credentials

This creates an RCP-owned HttpOnly session cookie and verifies access through the approved Autheory JWT/JWKS path. It never trusts browser-supplied x-autheory-* headers.

Visibility remains read-only and non-authoritative. Deploy, pin, unpin, rollback, and promote actions are not available.