login: take the unified-login cookie decode from ecore

authn's CookieName, the fernet decrypt, the auth.AuthCookie unmarshal and the
empty-name check were one of six copies of the same decode on this instance.
They are now sr-ht-ecore/login.UsernameFromRequest; what stays here is the half
that is ours, turning that name into a row in our user table.

Two things the local copy did not do. It passed the cookie's name through with
a leading '~' still on it, which meta answers for nobody, and it validated
nothing at all — a name went from an attacker-supplied cookie straight into a
GraphQL query and a log line. Both are now login's, and the middleware's own
rule is unchanged: every failure is anonymity, so public browsing and public
clones keep working.

test: build the fixture config and the keyset with ecoretest

The hand-built ini in web_test.go, the random fernet key in authn's
TestMain and the same seeding copied into the git-hook test are one call
to ecoretest now. The keys are fixed rather than generated on purpose:
they secure nothing inside a test process, and a constant keyset is what
lets two packages of this service initialise without the second rotating
what the first sealed with.

The synthetic instance runs in production mode, so the environment
banner is off in tests unless one asks for it.

rename module to sourcecraft.dev/bigbes/sr-ht-dolt; depend on sourcecraft sr-ht-core

authn: cookie, PAT, and dolt-JWT caller resolution

Add the authn package resolving the SourceHut caller across dolt.sr.ht's
three auth flows, producing core-go *auth.AuthContext values mapped onto the
pure core.Caller domain type:

- ctx.go: WithCaller/CallerFromContext (nil for anonymous, never panics) and
  AsCoreCaller (maps UserType, derives Suspended).
- cookie.go: OptionalCookieMiddleware, the never-rejecting unified-login
  cookie reader (fernet decrypt -> {name} -> LookupUser); any failure degrades
  to anonymous so public browsing keeps working.
- token.go: ResolveBasic, the meta personal-access-token trio (offline
  DecodeBearerToken -> username match -> LookupUser + revocation) with a 60s
  positive cache keyed by sha512(password); TokenGrantsAllow gates
  dolt.sr.ht/repos RO/RW grants (empty grants pass).
- jwt.go: ResolveDoltJWT, EdDSA JWS verification for dolt keypair auth (kid ->
  KeyStore pubkey, alg=EdDSA, aud/exp/sub checked, iss ignored), reusing
  dolt's creds.PubKeyToKIDStr for the kid<->pubkey integrity check.
- grpc.go: ResolveGRPCAuth dispatching Basic/Bearer/anonymous.

Meta lookup + revocation sit behind the MetaBackend interface and JWT keys
behind the KeyStore interface (implemented later by db/), so tests forge
cookies (fernet), PATs (BearerToken.Encode) and real Ed25519 JWTs against
in-memory stubs with no network or Postgres.