Move auth server from federation to account

Account is now the OAuth authorization server with magic link login,
OAuth2 authorize endpoint, SSO logout, and session management.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app.py

@@ -1,12 +1,14 @@
 from __future__ import annotations
 import path_setup  # noqa: F401  # adds shared/ to sys.path
+from pathlib import Path
 
 from quart import g
+from jinja2 import FileSystemLoader, ChoiceLoader
 
 from shared.infrastructure.factory import create_base_app
 from shared.services.registry import services
 
-from bp import register_account_bp
+from bp import register_account_bp, register_auth_bp
 
 
 async def account_context() -> dict:
@@ -39,7 +41,15 @@ def create_app() -> "Quart":
         domain_services_fn=register_domain_services,
     )
 
+    # App-specific templates override shared templates
+    app_templates = str(Path(__file__).resolve().parent / "templates")
+    app.jinja_loader = ChoiceLoader([
+        FileSystemLoader(app_templates),
+        app.jinja_loader,
+    ])
+
     # --- blueprints ---
+    app.register_blueprint(register_auth_bp())
     app.register_blueprint(register_account_bp())
 
     return app