Add OAuth SSO, device ID, and silent auth to L2

- Replace L2's username/password auth with OAuth SSO via account.rose-ash.com
- Add device_id middleware (artdag_did cookie)
- Add silent auth check (prompt=none with 5-min cooldown)
- Add OAuth config settings and itsdangerous dependency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

l2/docker-compose.yml

@@ -52,7 +52,13 @@ services:
       - INTERNAL_URL_BLOG=http://blog:8000
       - INTERNAL_URL_CART=http://cart:8000
       - INTERNAL_URL_ACCOUNT=http://account:8000
-      # DATABASE_URL, ARTDAG_DOMAIN, ARTDAG_USER, JWT_SECRET from .env file
+      # OAuth SSO
+      - OAUTH_AUTHORIZE_URL=https://account.rose-ash.com/auth/oauth/authorize
+      - OAUTH_TOKEN_URL=https://account.rose-ash.com/auth/oauth/token
+      - OAUTH_CLIENT_ID=artdag_l2
+      - OAUTH_REDIRECT_URI=https://artdag.rose-ash.com/auth/callback
+      - OAUTH_LOGOUT_URL=https://account.rose-ash.com/auth/sso-logout/
+      # DATABASE_URL, ARTDAG_DOMAIN, ARTDAG_USER, JWT_SECRET, SECRET_KEY from .env file
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8200/')"]
       interval: 10s