Add OAuth SSO, device ID, and silent auth to L2

- Replace L2's username/password auth with OAuth SSO via account.rose-ash.com
- Add device_id middleware (artdag_did cookie)
- Add silent auth check (prompt=none with 5-min cooldown)
- Add OAuth config settings and itsdangerous dependency
- Register artdag_l2 client with account service

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -33,6 +33,7 @@ x-app-env: &app-env
   APP_URL_FEDERATION: https://federation.rose-ash.com
   APP_URL_ACCOUNT: https://account.rose-ash.com
   APP_URL_ARTDAG: https://celery-artdag.rose-ash.com
+  APP_URL_ARTDAG_L2: https://artdag.rose-ash.com
   INTERNAL_URL_BLOG: http://blog:8000
   INTERNAL_URL_MARKET: http://market:8000
   INTERNAL_URL_CART: http://cart:8000