Replace L2 JWT auth with OAuth SSO via account.rose-ash.com

- config.py: OAuth settings replace l2_server/l2_domain
- auth.py: full rewrite — login/callback/logout with itsdangerous
  signed state cookies and httpx token exchange
- dependencies.py: remove l2_server assignment, fix redirect path
- home.py: simplify /login to redirect to /auth/login
- base.html: cross-app nav (Blog, Market, Account) + Rose Ash branding
- requirements.txt: add itsdangerous

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

requirements.txt

@@ -2,6 +2,7 @@ celery[redis]>=5.3.0
 redis>=5.0.0
 requests>=2.31.0
 httpx>=0.27.0
+itsdangerous>=2.0
 fastapi>=0.109.0
 uvicorn>=0.27.0
 python-multipart>=0.0.6