Remove token auth

[tsubik]

Remove token (Bearer/JWT) auth from the API

Follow-up to #610. That PR added cookie auth next to the Bearer token and left both
running behind a DISABLE_BEARER_AUTH kill switch so the frontends could migrate.
Both now log in with cookies, so this deletes the token path for good — no more
non-expiring, non-revocable tokens in LocalStorage, and no Authorization header that
skips the CSRF check.

Breaking — deploy with the frontends

• POST /login no longer returns token, and no longer accepts auth[set_cookie]:
  auth + XSRF-TOKEN cookies are set on every successful login.
• Authorization: Bearer <jwt> is ignored; token-only requests get a 401.
• All authenticated unsafe requests now go through the CSRF double-submit check.

Removed

lib/auth.rb, the jwt gem (direct dep only — still transitive via omniauth),
DISABLE_BEARER_AUTH, #user_from_bearer_token / #bearer_token, the
JWT::VerificationError handler. AUTH_SECRET dropped from .env.sample,
docker-compose.yml and CI — also needs removing from the servers' shared .env.

Tests

authorize_headers now does a real login instead of minting a JWT, returning the
X-XSRF-TOKEN header a browser would send. Consequences:

• *_headers helpers are no longer memoized — the cookie jar is shared, so whichever
  role logged in last owns it; re-login per call keeps each request honest.
• New app: option, since both cookies are namespaced per app (observations_spec,
  download-session spec).