Add single-user GitHub OAuth, hardened for internet exposure

muse drives a download client and writes to the media library, so exposing it
publicly needs more than a login form.

It fails closed. Auth is on unless MUSE_AUTH=off is set explicitly, and when
it is on with incomplete config the app refuses to start rather than serving
open. The mode worth engineering against is not a broken login page, it is a
misconfigured deploy quietly publishing an unauthenticated download client.

Sessions are server-side: the cookie carries a 256-bit random token and
nothing else, and only its SHA-256 is stored. There is no signed payload to
get subtly wrong, a stolen database yields no usable cookies, and logout
revokes for real. The allowlist is re-checked on every request so removing a
user takes effect immediately rather than at session expiry.

OAuth state is compared with secrets.compare_digest, so a callback the user
did not initiate is rejected. MUSE_BASE_URL comes from config rather than
X-Forwarded-* because those headers are attacker-controllable and this one is
a redirect target.

CSP is default-src 'self' with no unsafe-inline, which is why the stylesheet
and script moved out of index.html into static files -- an injected <script>
now cannot execute. Also frame-ancestors 'none', base-uri 'none', nosniff,
DENY, no-referrer and HSTS. FastAPI's /docs, /redoc and /openapi.json are
disabled so the login page does not hand out a map of every endpoint.

/healthz is the only unauthenticated route and returns a bare ok, so the
container healthcheck works without leaking anything.

Verified: misconfigured auth refuses to boot; unauthenticated / redirects and
/api/* returns 401; a forged state is rejected 400; a junk cookie is 401; a
valid session for a non-allowlisted user is 401; all headers present; and the
UI renders with no CSP violations in the console.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

static/app.css

@@ -0,0 +1,68 @@
+:root{
+    --bg:#0f1115; --panel:#171a21; --line:#252a34; --fg:#e7e9ee;
+    --dim:#8b93a3; --accent:#5b8cff; --ok:#3fb950; --err:#f85149; --warn:#d29922;
+  }
+  @media (prefers-color-scheme:light){
+    :root{--bg:#f6f7f9;--panel:#fff;--line:#e2e5ea;--fg:#12151a;--dim:#5f6672;}
+  }
+  *{box-sizing:border-box}
+  body{margin:0;background:var(--bg);color:var(--fg);
+    font:15px/1.5 ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif}
+  header{position:sticky;top:0;z-index:5;background:var(--bg);
+    border-bottom:1px solid var(--line);padding:14px 18px}
+  .wrap{max-width:900px;margin:0 auto}
+  h1{margin:0 0 10px;font-size:17px;letter-spacing:.2px}
+  h1 small{color:var(--dim);font-weight:400;font-size:13px;margin-left:8px}
+  form{display:flex;gap:8px}
+  input{flex:1;padding:11px 13px;border-radius:9px;border:1px solid var(--line);
+    background:var(--panel);color:var(--fg);font-size:15px}
+  input:focus{outline:2px solid var(--accent);outline-offset:-1px}
+  button{padding:11px 18px;border-radius:9px;border:0;background:var(--accent);
+    color:#fff;font-weight:600;cursor:pointer;font-size:15px}
+  button:disabled{opacity:.5;cursor:default}
+  main{padding:18px}
+  .row{display:flex;gap:12px;align-items:center;padding:10px;border-radius:10px;
+    border:1px solid var(--line);background:var(--panel);margin-bottom:8px}
+  .row img{width:48px;height:48px;border-radius:6px;object-fit:cover;
+    background:var(--line);flex:none}
+  .meta{flex:1;min-width:0}
+  .t{font-weight:600;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+  .s{color:var(--dim);font-size:13px;white-space:nowrap;overflow:hidden;
+    text-overflow:ellipsis}
+  .get{background:transparent;border:1px solid var(--accent);color:var(--accent);
+    padding:7px 14px;font-size:14px}
+  .get.done{border-color:var(--ok);color:var(--ok)}
+  h2{font-size:13px;text-transform:uppercase;letter-spacing:.6px;color:var(--dim);
+    margin:26px 0 10px;display:flex;align-items:center;gap:10px}
+  h2 .count{text-transform:none;letter-spacing:0;font-weight:400;font-size:12px}
+  details{margin-top:10px}
+  summary{cursor:pointer;color:var(--dim);font-size:13px;user-select:none}
+  summary:hover{color:var(--fg)}
+  textarea{width:100%;min-height:120px;margin-top:9px;padding:11px 13px;
+    border-radius:9px;border:1px solid var(--line);background:var(--panel);
+    color:var(--fg);font:13px/1.6 ui-monospace,SFMono-Regular,Menlo,monospace;
+    resize:vertical}
+  textarea:focus{outline:2px solid var(--accent);outline-offset:-1px}
+  .hint{color:var(--dim);font-size:12px;margin-top:7px}
+  .bar{height:3px;border-radius:2px;background:var(--line);overflow:hidden;
+    margin-top:10px}
+  .bar i{display:block;height:100%;background:var(--accent);transition:width .4s}
+  .retry{background:transparent;border:1px solid var(--line);color:var(--dim);
+    padding:5px 11px;font-size:12px;font-weight:400}
+  .skipped{color:var(--err);font-size:12px;margin-top:8px}
+  .pill{font-size:12px;padding:2px 9px;border-radius:99px;border:1px solid var(--line);
+    color:var(--dim);white-space:nowrap}
+  .pill.imported{color:var(--ok);border-color:var(--ok)}
+  .pill.failed{color:var(--err);border-color:var(--err)}
+  .pill.downloading,.pill.searching,.pill.queued{color:var(--warn);border-color:var(--warn)}
+  .empty{color:var(--dim);padding:22px;text-align:center}
+
+/* Inline style="" attributes are blocked by the strict CSP (style-src 'self'
+   with no 'unsafe-inline'), so anything that used to be inline lives here.
+   Setting .style from JS is unaffected -- CSP governs markup, not the CSSOM. */
+.btnrow{display:flex;gap:9px;align-items:center;margin-top:9px}
+.bar i{width:0}
+.hidden{display:none}
+.who{float:right;font-weight:400;font-size:12px;color:var(--dim)}
+.who a{color:var(--dim);margin-left:9px}
+.who a:hover{color:var(--fg)}