feat: Implement PKCE authentication for IndieLogin.com

This fixes critical IndieAuth authentication by implementing PKCE (Proof Key
for Code Exchange) as required by IndieLogin.com API specification.

Added:
- PKCE code_verifier and code_challenge generation (RFC 7636)
- Database column: auth_state.code_verifier for PKCE support
- Issuer validation for authentication callbacks
- Comprehensive PKCE unit tests (6 tests, all passing)
- Database migration script for code_verifier column

Changed:
- Corrected IndieLogin.com API endpoints (/authorize and /token)
- State token validation now returns code_verifier for token exchange
- Authentication flow follows IndieLogin.com API specification exactly
- Enhanced logging with code_verifier redaction

Removed:
- OAuth metadata endpoint (/.well-known/oauth-authorization-server)
  Added in v0.7.0 but not required by IndieLogin.com
- h-app microformats markup from templates
  Modified in v0.7.1 but not used by IndieLogin.com
- indieauth-metadata link from HTML head

Security:
- PKCE prevents authorization code interception attacks
- Issuer validation prevents token substitution attacks
- Code verifier securely stored, redacted in logs, and single-use

Documentation:
- Version: 0.8.0
- CHANGELOG updated with v0.8.0 entry and v0.7.x notes
- ADR-016 and ADR-017 marked as superseded by ADR-019
- Implementation report created in docs/reports/
- Test update guide created in TODO_TEST_UPDATES.md

Breaking Changes:
- Users mid-authentication will need to restart login after upgrade
- Database migration required before deployment

Related: ADR-019

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

starpunk/routes/auth.py

@@ -89,11 +89,13 @@ def callback():
     Handle IndieLogin callback
 
     Processes the OAuth callback from IndieLogin.com, validates the
-    authorization code and state token, and creates an authenticated session.
+    authorization code, state token, and issuer, then creates an
+    authenticated session using PKCE verification.
 
     Query parameters:
         code: Authorization code from IndieLogin
         state: CSRF state token
+        iss: Issuer identifier (should be https://indielogin.com/)
 
     Returns:
         Redirect to admin dashboard on success, login form on failure
@@ -103,14 +105,15 @@ def callback():
     """
     code = request.args.get("code")
     state = request.args.get("state")
+    iss = request.args.get("iss")  # Extract issuer parameter
 
     if not code or not state:
         flash("Missing authentication parameters", "error")
         return redirect(url_for("auth.login_form"))
 
     try:
-        # Handle callback and create session
-        session_token = handle_callback(code, state)
+        # Handle callback and create session with PKCE verification
+        session_token = handle_callback(code, state, iss)  # Pass issuer
 
         # Create response with redirect
         response = redirect(url_for("admin.dashboard"))