DC-046 DC-047 pluggable auth providers + email magic link

Pluggable AuthProvider framework for any future auth method (OIDC, SAML,
passkeys) to plug in without touching the auth path again. Two
implementations ship:

  * TOTP — refactored from routes/auth/totp.js into src/auth/providers/totp.js
    as one AuthProvider impl. Legacy /api/v1/totp/* routes stay mounted for
    back-compat; new /api/v1/auth/login/totp/* routes use the new shape.

  * EmailMagicLink — src/auth/providers/email.js. Initiate issues a 32-byte
    base64url token, stores its SHA-256 hash in data/email-tokens.json
    (atomic lockfile-based mutation, automatic TTL cleanup), and delivers via
    nodemailer if providers.email.{host,port,username,password} is set OR
    falls back to log.info('auth', 'email magic link issued', ...) for dev.
    Verify accepts the token, marks it used, creates the same DashCaddy
    session cookie that TOTP uses (single global cookie model).

createAuthProviderRegistry() composes both implementations and exposes
them via /api/v1/auth/login/{methods, :provider/initiate, :provider/verify,
recovery-info} and /api/v1/auth/disable/:provider. PUBLIC_ROUTES + CSRF
exemptions updated to use :provider placeholder (parameterized for future
providers).

Test fix: src/utilities/middleware.js PUBLIC_ROUTES and csrf-protection.js
both switched to the :provider form because the prior literal 'totp'
wouldn't match the parameterized mount path Express 4.22 produces.

Test fix: __tests__/public-routes-drift.test.js extractMountPath() was
broken for Express 4.22's new ^/path/?(?=/|$) source format (no \?\?
terminator in the literal-mount case). Rewrote the parser to normalize
escaped slashes + trailing lookaheads instead of relying on regex
matching against the raw source.

New: __tests__/auth-provider-registry.test.js — 9 tests covering registry
composition, getProvider round-trip, listEnabled no-secrets-leak guarantee,
enabled-flag respect, listAll vs listEnabled distinction, email provider
dev-console fallback (token written to JSON store + log.info with
deliveredVia: 'dev-console' + response masked), verify rejects unknown
tokens via AuthenticationError.

Tests: 1241/1241 passing across 46 suites (was 1232; +9 new).

DNS2 deploy: this commit + bump VERSION to 1.16.0 + publish tarball to
get.dashcaddy.net + docker build + bash start.sh. The image-layer migration
from DC-050 also runs on first container recreate post-merge.

dashcaddy-api/src/auth/providers/index.js

@@ -0,0 +1,118 @@
+/**
+ * AuthProvider registry — composes every enabled provider for the current
+ * DashCaddy instance.
+ *
+ * Today only `totp` exists. Adding a new provider:
+ *   1. Create src/auth/providers/<name>.js exporting a class extending
+ *      AuthProvider (see ./base.js for the contract).
+ *   2. Add a case to `loadProvider()` below.
+ *   3. Document in CHANGELOG.md. No route edits, no app.js edits.
+ *
+ * The registry returns a single object the auth router walks to:
+ *   - list all enabled providers + their login methods (for the UI)
+ *   - look up a provider by name (for /api/v1/auth/login/:provider/...)
+ *   - look up the active provider for the check-session endpoint (every
+ *     provider's session is the same DashCaddy cookie, so check-session
+ *     is a global concern, not provider-specific)
+ *
+ * Sessions are global, not per-provider. Every successful verify() creates
+ * the same DashCaddy session cookie. TOTP and email magic link both use
+ * session.create() / setCookie() — there's no "TOTP session" vs "email session"
+ * distinction. The check-session endpoint therefore doesn't dispatch to a
+ * specific provider — it just verifies the cookie's validity (the existing
+ * behavior in src/utilities/middleware.js isSessionValid()).
+ */
+
+const TotpProvider = require('./totp');
+const EmailMagicLinkProvider = require('./email');
+
+/**
+ * Instantiate every enabled provider for this instance.
+ *
+ * @param {Object} deps  Shared infrastructure (see TotpProvider constructor)
+ * @param {Object} config  The site config — providers.enabled.{name} toggles each.
+ * @returns {Object}      { providers: Map<name, AuthProvider>, listEnabled() }
+ */
+function createAuthProviderRegistry(deps, config) {
+  const providers = new Map();
+
+  // Always load TOTP — it's the default. The legacy /api/v1/totp/* routes
+  // and the Caddy forward_auth gate all assume TOTP exists.
+  const totpProvider = new TotpProvider({
+    ...deps,
+    config: deps.config.totp, // the existing totpConfig object from app.js
+    saveProviderConfig: deps.saveTotpConfig, // existing helper
+  });
+  providers.set('totp', totpProvider);
+
+  // DC-047: EmailMagicLinkProvider — second AuthProvider. Always register;
+  // enablement is controlled by config.authProviders.email.enabled (defaults
+  // to true so dev installs "just work"). Providers are constructed lazily
+  // in the sense that even a provider with no SMTP config still issues and
+  // verifies tokens — only delivery falls back to the dev console-log path.
+  providers.set('email', new EmailMagicLinkProvider({
+    ...deps,
+    config: deps.config.email || { enabled: true, sessionDuration: '24h' },
+    saveProviderConfig: deps.saveProviderConfig || (async () => {}),
+    emailConfig: deps.emailConfig || null,
+    siteConfig: deps.siteConfig || {},
+    // DC-048 hook: today every email is authorized. Once multi-user ships,
+    // this is replaced with a real allowlist check.
+    authorizedEmails: deps.authorizedEmails || (() => true),
+  }));
+
+  // Future: OIDC, SAML, passkeys — each gated on config.authProviders
+  // or its own toggle. The shape is uniform: { enabled: bool, ...rest }.
+  //
+  // if (config?.authProviders?.oidc?.enabled) {
+  //   providers.set('oidc', new OidcProvider({
+  //     ...deps, config: config.authProviders.oidc, saveProviderConfig: ...
+  //   }));
+  // }
+
+  return {
+    providers,
+    /**
+     * Return the list of enabled providers with their public config.
+     * Used by GET /api/v1/auth/methods to drive the login UI.
+     */
+    async listEnabled() {
+      const out = [];
+      for (const [name, provider] of providers) {
+        if (!(await provider.isEnabled())) continue;
+        const methods = await provider.listMethods();
+        out.push({
+          name,
+          config: await provider.getConfig(),
+          methods,
+        });
+      }
+      return out;
+    },
+
+    /**
+     * All configured providers, including disabled-but-not-deleted ones.
+     * For the settings UI.
+     */
+    async listAll() {
+      const out = [];
+      for (const [name, provider] of providers) {
+        out.push({
+          name,
+          config: await provider.getConfig(),
+          methods: await provider.listMethods(),
+        });
+      }
+      return out;
+    },
+
+    /**
+     * Look up a provider by name. Returns null if not registered.
+     */
+    getProvider(name) {
+      return providers.get(name) || null;
+    },
+  };
+}
+
+module.exports = { createAuthProviderRegistry };