Notify the application when a user completes a sign-in

[einari]

Adds a service-to-service back-channel that notifies the application every time a user actually signs in — when a signed-out user completes an interactive identity-provider login and a fresh session is established. This is the AuthProxy half of Cratis/Studio#877; the application (Studio) records a sign-in event so users can later be notified of new sign-ins.

Added

• Sign-in notification back-channel: on a genuine logged-out → signed-in transition, AuthProxy POSTs { subject, identityProvider, ipAddress, location, browser, operatingSystem, userAgent } to a configured application endpoint (Cratis/Studio#877).
• New configuration key Cratis:AuthProxy:SignIn:NotifyUrl, alongside the existing Invite:ExchangeUrl and Link:ExchangeUrl. Leave it unset to disable notifications (Cratis/Studio#877).
• Approximate location derived from the client IP (honoring X-Forwarded-For) and any geo headers a fronting CDN/proxy adds (CF-IPCountry, X-Geo-*, X-AppEngine-*) — no heavy geo-IP dependency; when no geo headers are present only the IP travels (Cratis/Studio#877).
• Lightweight built-in User-Agent parsing into browser and operating system, with the raw header also forwarded (Cratis/Studio#877).
• Documentation: Documentation/configuration/sign-in.md, wired into the configuration TOC (Cratis/Studio#877).

Behavior notes

• The notification fires only from the provider callback (OnTicketReceived), so it is scoped to real sign-ins — never on reused sessions or ordinary proxied requests. The credential-link flow short-circuits before this point, so a link is never reported as a sign-in.
• Recording a sign-in is best-effort: any failure is logged and swallowed, and never breaks the sign-in itself.

Security

• The endpoint is a service-to-service back-channel that carries no bearer token (there is no user-supplied token in this flow); it relies on being network-isolated from browser traffic, exactly like the invite and link exchanges. It trusts the subject AuthProxy delivers from a real provider authentication, never a client-supplied subject.
• The client IP and derived location are personal data; the application is responsible for handling and retention.

Deployment wiring (set Cratis:AuthProxy:SignIn:NotifyUrl to the Studio Core internal endpoint) is a follow-up and is not part of this PR.