Lift the common auth flow out of turf-monster into the engine so every
Studio app runs one passwordless-first flow (magic-link + Google + wallet).

- Config: Studio.auth_methods / auth_method? + magic_link_ttl /
  magic_link_token_name / mailer_from. :password is opt-in and re-arms the
  User#authenticate contract check.
- Leaf components: SessionContext PORO, Current baseline, MagicLink service,
  GoogleOauthValidator, Solana::SessionAuth concern (solana-studio is
  host-provided + only loaded when wallet sign-in is on).
- Studio::ErrorHandling: session_token binding (OPSEC-045) + onchain reset in
  set/clear_app_session, format-aware require_authentication (OPSEC-046),
  set_current_context / verify_session_token / onchain_session? /
  wallet_context / client_session_payload.
- Base controllers (generic; apps override): MagicLinks (create-or-login),
  SolanaSessions (nonce/verify), OmniauthCallbacks now runs GoogleOauthValidator.
- UserMailer#magic_link + ApplicationMailer + app-name-aware templates.
- Routes gated by auth_method?.

Backend half only; shared wallet JS + Connect-Wallet modal land with the first
consumer wiring. Not yet published/tagged — validated against mcritchie first.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>