Phase 14c-1: editor auth on iManager 2.0 (login/logout, CSRF)

[bigin]

Summary

The /editor/ admin shell now boots through a brand-new
Scriptor\Boot\Editor\ namespace on the iManager 2.0 container —
no calls into the legacy Scriptor::build() / editor/core/ path
on the public auth flow.

• Editor\Editor — surface for theme/template.php (siteUrl, themeUrl,
  version, csrf, msgs, pageTitle, pageContent, breadcrumbs, jsConfig,
  i18n, sanitizer, urlSegments, session). Loads legacy lang/<lang>.php
  verbatim.
• Editor\EditorRouter — routes /editor/<module>/<action>; auth is
  live, every other slug returns a typed "coming back in 14c-N"
  placeholder so the branch stays end-to-end testable until the
  remaining modules ship.
• Editor\UserRepository — thin lookup over CategoryRepository +
  ItemRepository for the Users category.
• Editor\Auth\AuthModule — login form + login/logout handlers on
  Imanager\Http\Csrf, Request, SessionStore. Verifies bcrypt hashes
  via password_verify(); accepts both the new plain-string password
  field and the migrated 1.x {__class, password, salt} wrapper.
• Editor\Auth\LoginAttempts — session-scoped IP lockout
  (maxFailedAccessAttempts / accessLockoutDuration from
  scriptor-config).

Bootstrap: ImanagerBootstrap registers NativeSessionStore (namespaced
scriptor) and Csrf (maxTokens=10).

Editor entry / theme: editor/index.php's 1-line legacy include
replaced by an explicit require boot.php + new Editor + EditorRouter.
editor/theme/{template,header,summary}.php trimmed: drop the 1.x
IS_IM define, drop \Scriptor\Core\Scriptor::VERSION, switch the
profile/sidebar menus to the new $editor surface (isLoggedIn(),
urlSegments, csrfQueryString()).

CSRF: every login POST and logout GET must carry a token; failures
flash a translated error_csrf_token_mismatch error.

Test plan

• GET /editor/auth/ → 200, login form, CSRF token len=64
• POST /editor/auth/ wrong creds → 200, error msg, attempts++
• POST /editor/auth/ admin / gT5nLazzyBob → 302 → /editor/
• GET /editor/ (auth) → 200 dashboard with sidebar
• GET /editor/pages → 200 placeholder (14c-2)
• GET /editor/auth/logout/?tokenName=…&tokenValue=… → 302 → /editor/auth/
• GET /editor/ after logout → 200 login form
• Browser smoke against ServBay