feat: AYON single-sign-on (ticket exchange, task boards, browser entry)

- POST /api/auth/ayon/exchange: redeem single-use ticket (issued by the
  AYON addon) via AYON_EXCHANGE_URL, mint session JWT, get-or-create
  internal user row and the <project>/<task> board in the AYON collection
- db: getOrCreateAyonUser / getOrCreateAyonBoard / grantAyonCollectionAccess
- frontend: /b route redeems ticket from URL and forwards to the board
- password login/register paths untouched (legacy instance support)

frontend/src/App.tsx

@@ -6,6 +6,7 @@ import CollectionList from './pages/CollectionList';
 import CollectionDetail from './pages/CollectionDetail';
 import Editor from './pages/Editor';
 import Admin from './pages/Admin';
+import AyonEntry from './pages/AyonEntry';
 
 function ProtectedRoute({ children }: { children: React.ReactNode }) {
   const { user, loading } = useAuth();
@@ -32,6 +33,7 @@ function AppRoutes() {
   return (
     <Routes>
       <Route path="/login" element={<Login />} />
+      <Route path="/b" element={<AyonEntry />} />
       <Route path="/" element={<ProtectedRoute><CollectionList /></ProtectedRoute>} />
       <Route path="/collection/:collectionId" element={<ProtectedRoute><CollectionDetail /></ProtectedRoute>} />
       <Route path="/board/:boardId" element={<ProtectedRoute><Editor /></ProtectedRoute>} />