* APIs for login and register
* return 403 instead of 423 if account is locked
* add login API route to ratelimiter
* APILogin remove browser token gen & return, give API token instead
* generalize login logic
* remove transient user handling
* remove APIRegisterChallenge due to unnecessary
* remove honeypot from APIRegister
* APIRegister remove browser token gen & return, give API token instead
* add register API route to ratelimiter
* add missing API godoc
* Clean up app.Login error handling
* Fix rate-limit errors for API routes
* Deduplicate APICreateUser and APIRegister
* Rate-limit all non-admin unsafe API requests
* APILogin test
* Make SetIsLocked write to the tx
* Add CORSAllowOrigins option
* Assert SetIsLocked without err variable
* Fix and test API rate limiting
---------
Co-authored-by: Evan Goode <mail@evangoo.de>
