feat: separate admin service into auth and firebase auth

[frodi-karlsson]

Introduces replacements for the base admin service via two modules that are more generically useful and composable:

• FirebaseAuthService - verifies Firebase ID tokens: reads the token from a configured cookie/header and resolves it to an email. Also serves the Firebase login page and login handler.
• AuthService - the provider-agnostic auth flow. The app supplies authenticate (who is this) and getPermissions (what may they do). The service then handles resolving the caller's status based on these, requiring various things, and constructing auth middlewares

const firebaseAuthService = new FirebaseAuthService(() => firebaseService.auth(), {
  tokenCookie: 'my_token',
  tokenHeader: 'x-my-token',
})

const authService = new AuthService<{ req: BackendRequest }>({
  authenticate: req => firebaseAuthService.getEmailByToken(firebaseAuthService.getToken(req)),
  getPermissions: email => getPermissionsFromDb(email),
  onCheck: (check, ctx) => auditLog(check, ctx), // optional
  authEnabled: env.authEnabled,
})

// Use as middleware
const requireAuth = authService.getLoginRedirectMiddleware({ loginHtmlPath: '/login.html' })
router.get('/users', requireAuth(['READ_USERS']), handler)

// Or resolve first, then check synchronously
const resolved = await authService.resolve(req)
authService.require(resolved, ['WRITE_USERS'], { ctx: { req, recordId } }) // 401 / 403

Note

I really like the commit sha: fabdbbb