feat(steam): verify the Steam ID with Sign in through Steam

The Steam ID is no longer typed in at registration or in the settings.
A logged-in user links it through Steam OpenID 2.0: Auth checks the
answer with Steam (check_authentication) and stores the ID as verified
(V11 steam_id_verified). A one-time state plus a binding cookie tie the
callback to the browser that started the link, so a foreign Steam login
link cannot move someone's Steam ID into another account.

Typed-in IDs from before stay unverified; a verified link from another
account takes them away. DELETE /api/users/steam-link unlinks.

src/main/resources/application.yml

@@ -51,6 +51,10 @@ app:
   auth:
     cookie-domain: ${APP_AUTH_COOKIE_DOMAIN:}
     cookie-secure: true
+  # Auth's own public address: Steam sends the user back here after "Sign in through Steam".
+  public-url: ${APP_PUBLIC_URL:http://localhost:8080}
+  # Where the user lands after the Steam link.
+  frontend-url: ${APP_FRONTEND_URL:http://localhost:5173}
 
 # Registration settings
 auth: