auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

server: add @private directive glue code

Enforce complexity limit on webhook payload

Configure server to manage mail queue

This also sets up the recovery function for webhooks, so we get emailed
when we panic during a webhook query.

server: add server reference to context

webhooks: initial prototype for GQL-native webhooks

Fix bug with internal authentication

Make authorization errors more specific

server: set max upload size to 1 GiB

Stash remote address in context

Sign outgoing emails

Add legacy webhooks worker implementation

Expand context for work queues

server: use SO_REUSEADDR for main listener

server: add /query/api-meta.json, docs

server: incorporate queue management

Simplify server module

Add email work queue

Import GQL server interfaces from gql.sr.ht