feat: session-cookie login/logout + three-tier roles (superadmin/admin/viewer) with read-only UI + remove pink theme

- cookie-based auth (/login /logout) replacing Basic Auth for UI, enabling logout
- roles: superadmin (account management only), admin (full except accounts), viewer/audit (read-only status+cluster, export logs)
- readonly accounts hide edit buttons (added remote node, group ops, canvas layout/save/import, cluster manage, install) instead of greying them
- auditors see status+cluster only; ordinary admins lose the accounts nav; last-admin guard covers superadmin
- remove pink theme entirely (switcher, [data-theme=pink], leftover localStorage), keep white/blue

cmd/webui4frpc/main.go

@@ -253,12 +253,13 @@ func main() {
 	})
 
 	h := &httpapi.Handler{
-		Store:   st,
-		Process: pm,
-		WorkDir: wd,
-		BinDir:  filepath.Join(wd, "bin"),
-		Cluster: reg,
-		Ring:    ring,
+		Store:    st,
+		Process:  pm,
+		WorkDir:  wd,
+		BinDir:   filepath.Join(wd, "bin"),
+		Sessions: httpapi.NewSessionStore(),
+		Cluster:  reg,
+		Ring:     ring,
 		// SelfAddr must be reachable by peers. 0.0.0.0/empty on a real host
 		// would break peer reconnect, so fall back to the hostname (container
 		// name inside docker is a routable addr on the compose network).