Add OAuth SSO, device ID, and silent auth to L2

- Replace L2's username/password auth with OAuth SSO via account.rose-ash.com
- Add device_id middleware (artdag_did cookie)
- Add silent auth check (prompt=none with 5-min cooldown)
- Add OAuth config settings and itsdangerous dependency
- Register artdag_l2 client with account service

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

account/bp/auth/routes.py

@@ -43,7 +43,7 @@ from .services import (
 SESSION_USER_KEY = "uid"
 ACCOUNT_SESSION_KEY = "account_sid"
 
-ALLOWED_CLIENTS = {"blog", "market", "cart", "events", "federation", "artdag"}
+ALLOWED_CLIENTS = {"blog", "market", "cart", "events", "federation", "artdag", "artdag_l2"}
 
 
 def register(url_prefix="/auth"):

docker-compose.yml

@@ -33,6 +33,7 @@ x-app-env: &app-env
   APP_URL_FEDERATION: https://federation.rose-ash.com
   APP_URL_ACCOUNT: https://account.rose-ash.com
   APP_URL_ARTDAG: https://celery-artdag.rose-ash.com
+  APP_URL_ARTDAG_L2: https://artdag.rose-ash.com
   INTERNAL_URL_BLOG: http://blog:8000
   INTERNAL_URL_MARKET: http://market:8000
   INTERNAL_URL_CART: http://cart:8000