feat: phase 3 admin magic-link auth — tokens, sessions, rate limits, audit

End-to-end passwordless admin auth. /admin/login accepts an email, POSTs
mint a 256-bit magic-link token stored only as SHA-256 in
magic_link_tokens (15-min TTL, single-use via atomic rowcount UPDATE).
Resend delivers the link; in dev with no API key, EmailService logs a
structured magic_link_dev_fallback event with the URL so the flow works
offline. /admin/auth/consume/{token} verifies, upserts a users row
(display_name from email local-part), creates a sessions row, and drops
an itsdangerous-signed cb_session cookie (HttpOnly, SameSite=Lax, Secure
in prod). /admin renders a placeholder "Welcome, <name>" page pending
Phase 4 CMS. /admin/logout flips revoked_at rather than deleting the row
to preserve the audit trail.

Rate limits use SlowAPI's in-memory limiter (5/15min/IP on login,
20/15min/IP on consume) plus a DB per-email count to catch
IP-rotating abuse. ADMIN_EMAILS enforces allowlist; non-allowlisted
submissions return the same "check your inbox" page with no token
inserted and no email sent (anti-enumeration). Every event lands in
auth_events via AuditService: link_requested, link_consumed,
consume_failed, session_created, session_revoked, rate_limited.

Add a production config validator refusing empty RESEND_API_KEY,
RESEND_FROM, or ADMIN_EMAILS; add PUBLIC_BASE_URL for email link
construction. CSRF deferred to Phase 6 per roadmap scoping; logout
handler marked # TODO(phase-6-csrf).

Mark Phase 3 complete in docs/ROADMAP.md.

app/templates/admin/login.html

@@ -0,0 +1,48 @@
+{#
+  Admin login form.
+
+  Single email input, no JS. If the submitted address is on the
+  allowlist (ADMIN_EMAILS env var), the POST handler emails a
+  one-time magic link; otherwise it silently succeeds without
+  sending (anti-enumeration).
+
+  Context:
+    - error  : str | None  (format validation errors only)
+    - email  : str         (pre-fill on re-render after format error)
+#}
+{% extends "admin/base.html" %}
+
+{% block title %}Log in — Admin{% endblock %}
+
+{% block content %}
+  <article class="page-article">
+    <header class="page-article__header">
+      <h1 class="page-article__title">Admin log in</h1>
+    </header>
+
+    <p>
+      Enter your admin email and we'll send a one-time login link
+      that expires after 15 minutes.
+    </p>
+
+    {% if error %}
+      <p class="admin-flash admin-flash--error" role="alert">{{ error }}</p>
+    {% endif %}
+
+    <form class="contact-form" action="/admin/login" method="post" novalidate>
+      <div class="contact-form__field">
+        <label for="admin-email">Email</label>
+        <input type="email"
+               id="admin-email"
+               name="email"
+               autocomplete="email"
+               value="{{ email or '' }}"
+               required>
+      </div>
+
+      <div class="contact-form__actions">
+        <button type="submit" class="btn btn--primary">Send login link</button>
+      </div>
+    </form>
+  </article>
+{% endblock %}