rename the service to diff.sr.ht

The instance-facing name changes and nothing else does: the config.ini section,
the origin, the apk package, the nginx block and the systemd unit are all
diff.sr.ht now, and the brand's red service label reads "diff" because chrome
derives it from the section name.

What deliberately stays is everything whose rename would cost more than it is
worth: the Go module path, the repository name, the comparesrht binary, and the
/~owner/repo/compare/base...head routes people have in their history. README
says so at the top so the split is not read as an oversight.

rename module to sourcecraft.dev/bigbes/sr-ht-compare; depend on sourcecraft sr-ht-core

authz: unified-login identity and git.sr.ht GraphQL authorization

Add the authz package: cookie-derived identity and per-request repository
authorization delegated to git.sr.ht's internal GraphQL API, with no local
database.

- identity.go: UsernameFromRequest decrypts the sr.ht.unified-login.v1 Fernet
  cookie to a bare username ("" for anonymous, never rejects); Middleware/
  ForContext carry it in the request context.
- authz.go: Authorizer interface + GQLAuthorizer over core-go client.Do. Repo
  strips a leading ~ from the owner, maps null user/repository to
  core.ErrNotFound (never leaking existence) and transport/GraphQL failures to
  a wrapped non-NotFound error. MyRepos paginates me{repositories} to a 500-repo
  cap. A mutex-guarded TTL cache memoizes positive and not-found Repo results
  (keyed viewer\0owner\0name) but never transport errors, with lazy expiry and
  opportunistic sweeps.
- Tests: in-memory config (generated Fernet + ed25519 keys) + httptest server
  asserting the Internal auth header decrypts to the expected viewer; covers
  cookie round-trip, found/null/500 repo cases, per-viewer cache keying, TTL
  expiry, transport-error non-caching, and MyRepos pagination.