DC-049 auth gate UI: pluggable provider selector + email challenge

New module status/js/auth-gate.js owns the Caddy ?auth=required flow.
On load it queries GET /api/v1/auth/login/methods to discover which
AuthProviders are configured. Three branches:

  * 0 providers  → legacy TOTP overlay (delegates to window._showTotpOverlay)
  * 1 provider (totp only) → legacy TOTP overlay (delegates, no UI change)
  * 2+ providers → provider selector with 'Sign in with …' buttons

Email provider challenge is a single email input + 'Send sign-in link'
button. POST to /api/v1/auth/login/email/initiate. On success the UI
shows 'check the server logs' message if deliveredVia == 'dev-console'
(production hosts without SMTP fall back gracefully) or 'check your
inbox' when SMTP is configured.

TOTP button just calls window.location.reload() — simplest path because
totp-auth.js wires the 6-digit input handlers at module-load time, and
a reload re-runs all IIFEs with the original markup. Same behavior as
the legacy single-provider path.

Coordination with totp-auth.js: auth-gate.js sets window.__dc_049_handled
= true at IIFE entry. totp-auth.js's top-level ?auth=required check
reads that flag and skips its own UI when set — eliminates the flicker
in multi-provider installs. Single-provider installs still work because
the legacy code path is unchanged (auth-gate delegates to it).

Bundle order in build.js: auth-gate.js BEFORE totp-auth.js so the flag
is set in time.

Webpack-style bundle markers verified offline: __dc_049_handled,
auth-gate-email-input, provider-btn, _showAuthGate, totp_redirect all
present in dist/core.js (now 20 files, 248KB raw / 153KB min). New SW
cache hash dashcaddy-shell-680e230383 (was 743f9c17b0).

status/js/totp-auth.js

@@ -111,9 +111,13 @@
     }
   }
 
-  // Handle ?auth=required redirect from Caddy SSO
-  const urlParams = new URLSearchParams(window.location.search);
-  if (urlParams.get('auth') === 'required') {
+  // Handle ?auth=required redirect from Caddy SSO.
+  // DC-049: if the auth-gate module will handle this (multi-provider
+  // installs), skip our TOTP-only branch entirely. Single-provider
+  // TOTP-only installs continue to use this path because auth-gate.js
+  // delegates back to window._showTotpOverlay().
+  const __dc_049_skip = !!(window.__dc_049_handled);
+  if (!__dc_049_skip && urlParams.get('auth') === 'required') {
     const returnUrl = urlParams.get('return');
     if (returnUrl) {
       // Validate redirect URL: must be same-origin or hostname must end with our TLD