feat(settings): link the Steam account through Steam

A Steam card in the settings links, verifies or unlinks the Steam
account through "Sign in through Steam". After the way back the page
shows the outcome and refreshes the session, so Core gets the new
Steam ID at once. Registration and settings no longer ask for a typed
Steam ID.

src/utils/steamLink.js

@@ -0,0 +1,26 @@
+import {apiFetch} from './api.js';
+
+// Only Steam's own login page; a URL from an API must not send the user anywhere else.
+export const STEAM_LOGIN_PREFIX = 'https://steamcommunity.com/openid/login?';
+
+/**
+ * POST /api/users/steam-link, then leaves the page for Steam's login. The caller handles a response that is not ok.
+ *
+ * @returns the response; when it is ok the browser is already on its way to Steam
+ */
+export async function startSteamLink() {
+    const response = await apiFetch(`${import.meta.env.VITE_API_URL}/api/users/steam-link`, {method: 'POST'});
+    if (!response.ok) return response;
+    const {redirectUrl} = await response.json();
+    if (typeof redirectUrl !== 'string' || !redirectUrl.startsWith(STEAM_LOGIN_PREFIX)) {
+        throw new Error('Auth sent no Steam login URL');
+    }
+    window.location.assign(redirectUrl);
+    return response;
+}
+
+/**
+ * DELETE /api/users/steam-link. Auth sets a new access cookie without the Steam ID.
+ */
+export const unlinkSteam = () =>
+    apiFetch(`${import.meta.env.VITE_API_URL}/api/users/steam-link`, {method: 'DELETE'});