feat(self-hosted-auth): self-hosted username/password identity provider

[adrians5j]

What changed

Adds a self-hosted username/password identity provider for the pure-Node (-server) flavour of Webiny — a first-party alternative to Cognito/Auth0 that needs no external auth service.

It plugs into Webiny's existing IdP interface exactly like Cognito does: it registers a JwtIdentityProvider that recognises and verifies its own tokens (matching on the webiny-self-hosted issuer), so it coexists with any other provider with zero core changes. The half that Cognito delegates to an external service — issuing tokens — is implemented here as a public selfHostedAuthLogin(email, password) GraphQL mutation that verifies the credential and mints a signed JWT.

Two packages, mirroring the cognito/auth0 sibling pattern:

• @webiny/self-hosted-auth — database-agnostic auth logic:
  • scrypt password hashing via node:crypto (zero native dependencies). Hashes are self-describing (scrypt$N$r$p$salt$hash), so a future Argon2id hasher can be dropped in without a migration.
  • HS256 JWT issue/verify (jsonwebtoken), with the signing secret injected via config or WEBINY_SELF_HOSTED_AUTH_SECRET.
  • LoginUseCase, SetPasswordUseCase, and a UserInstaller that seeds the first admin (creates the user via api-core, then sets its password, with rollback on failure).
  • A CredentialsStorageOperations seam so credential storage stays pluggable per database.
• @webiny/self-hosted-auth-sql — the thin Knex implementation of CredentialsStorageOperations, following the repo's existing storage-ops pattern (lazy table ensure, JSON data column). Credentials live in their own table, never on the admin-user record.

Security niceties: login returns a single generic error and runs a dummy hash on missing accounts to keep timing roughly constant, mitigating user enumeration.

Scope / follow-ups (not in this PR): no automated tests yet; no Mongo (-mdb) storage package yet; no admin-side login UI; and SetPasswordUseCase carries a TODO(authz) for self-service-vs-admin-reset enforcement. There is also a v0 tenancy decision (credentials resolved by email alone) documented in LoginUseCase.

Changelog

Self-hosted username & password login

Webiny can now run with its own built-in username-and-password sign-in, so a self-hosted deployment no longer needs an external login service. Administrators get a first account set up automatically during installation.

Squash merge commit

feat(self-hosted-auth): add username/password identity provider (#5367)
feat(self-hosted-auth): self-hosted auth with scrypt + JWT (#5367)