Add OAuth SSO, device ID, and silent auth to L2

- Replace L2's username/password auth with OAuth SSO via account.rose-ash.com
- Add device_id middleware (artdag_did cookie)
- Add silent auth check (prompt=none with 5-min cooldown)
- Add OAuth config settings and itsdangerous dependency

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

l2/requirements.txt

@@ -7,6 +7,7 @@ bcrypt>=4.0.0
 python-jose[cryptography]>=3.3.0
 markdown>=3.5.0
 python-multipart>=0.0.6
+itsdangerous>=2.1.0
 asyncpg>=0.29.0
 boto3>=1.34.0
 # common (artdag_common) installed from local dir in Dockerfile