v0.78.1: Security fixes

Sign-in and account hardening. Update soon, especially if people outside your household can reach your server.
Thank you to @globalteddy, who reported these and wrote the fixes.

Security fixes

• A session follows its account as it is now. Disabling or deleting an account ends its sessions on their next
  request, and taking away someone's admin role takes it away at once, not when their session is next renewed.
• An admin's API token needs the admin scope for every admin-only action, not only under /api/admin: stopping
  someone else's download or archive, or seeing a series' admin details. Without it, the token acts as an ordinary
  account.
• Covers and pages fetched on your behalf connect only to public addresses, checked at the moment of connecting.
• A stranger's wrong passwords no longer lock an account. Five wrong passwords for one name from one address pause
  sign-in for that name from that address for 15 minutes, and the account's owner can still sign in from anywhere
  else. Wrong two-factor codes, and wrong current passwords behind a signed-in session, still lock the account.
• Sign-in answers every wrong guess the same way, whether the name exists or not. A disabled or locked account is
  told so only once the right password is given.

Changed

• A sign-in that is being rate-limited says so in your language.

Fixed

• Health's "Chapters that would not download" no longer says a chapter a site refused was left alone after three
  tries while Finish downloads on their own is still trying it. Its note says how many tries a refused chapter gets.
• Health's Chapter gaps note read "…greyed with what it found.; Numbers none of…" since v0.78.0. Its sentences are
  joined as sentences now.

Upgrading

• API: POST /auth/login answers 429 with Retry-After after five failed passwords for one name from one
  address in 15 minutes. A wrong password for a disabled or locked account is now 401 invalid_credentials; the
  right one is still 403 disabled or 423 locked. See docs/api.md.
• Database: no change.

Uchiyomi Desktop (beta): downloads

Uchiyomi as a program on your own computer, for Windows and Mac. On first launch it asks how you want to
use it: on this computer (the whole app, with the library in a folder on your PC and no Docker or
server to run) or connected to your own Uchiyomi server (a window onto the server you already run).

Your computer	Download
Windows (x64)	Uchiyomi-Setup-0.78.1.exe
Mac with Apple silicon (M1 or newer)	Uchiyomi-0.78.1-arm64.dmg
Mac with an Intel processor	Uchiyomi-0.78.1-x64.dmg

Only those three are for you: the .zip, .blockmap and latest*.yml files are what the app's own updater
reads. The same installers are also here under names without a version (Uchiyomi-Setup.exe,
Uchiyomi-mac-arm64.dmg, Uchiyomi-mac-x64.dmg), which always lead to the newest release.

The app is not signed yet, so the first launch takes one extra step:

• Windows: "Windows protected your PC" appears once. Choose More info, then Run anyway. A PC
  with Smart App Control turned on blocks unsigned apps with no way past it; use the Docker install there.
• macOS: open the dmg and drag Uchiyomi to Applications. The first time you open it, macOS refuses;
  go to System Settings → Privacy & Security and choose Open Anyway.

Windows installs updates by itself. A Mac cannot update an unsigned app, so there a new version is a new
download; the menu-bar icon and Admin → Health say when one is out.

Step by step, with pictures -- which file, the first launch on each system, the two ways to use it, adding
sources, updates, backups, where files live and uninstalling:
the desktop guide.