Sign in to the console with the Core key (web)

[SaladDay]

Frontend half of the Core key login pair (W1). It targets the backend branch codex/core-key-login; the paired branch goes to main as one PR after the full gate.

• Sign-in.
  • The sign-in panel has one Core key field.
  • Help text explains where the key is: admin/core.key under the installation directory, ~/.parsar/core/admin/core.key by default. It also says the key is an administration credential that can't call /v1 and is never kept in the browser.
  • The key is trimmed before it's sent as {"core_key": …}, and an empty key isn't submitted.
• Errors by status: 401 wrong key; 429 with the Retry-After wait; 503 unavailable; 400, 415 and network failures as a generic failure.
• First run: Core key sign-in → first project and key → tour. The administrator-account step, the username/password forms and the legacy Basic branch are removed. There is no username any more.
• /console/config: a missing sandbox_admin counts as granted, because P2a drops sandbox_admin and api_keys.
• Terminology: "project API key" for application keys and "Core key" for the administration credential.
• e2e: the fixture signs in with a fixed Core key and returns 401 and 429 (with Retry-After). The sign-in test covers wrong key, right key, the key not stored in the browser, sign-out and back, and 429. The fresh-install test goes sign-in → first project → tour.
• Docs: the console configuration is CORE_CONSOLE_CORE_KEY_FILE; AUTH_MODE and STATE_DIR are gone. Console operations show the audit actor console; direct Core key calls leave it empty.

Validation: typecheck, 327 web unit tests, 15 browser acceptance tests on headless Chromium, run on top of e3d5cd61.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}