Per-host HTTP basic auth (#57)

Adds opt-in basic auth per Host, following the existing per-host controls
pattern:
- Host fields basicauth_enabled / basicauth_realm / basicauth_users
  ({user: base64(sha1(pw))}). Credentials are parsed to plaintext by the pure
  host_features normalizer and hashed at the route layer (utils/basicauth.js),
  so plaintext never reaches Redis.
- ops/nginx_conf/hostfeatures.lua enforces it in access phase: verifies the
  Authorization header against base64(sha1(password)), fails closed with a 401
  WWW-Authenticate challenge.
- hosts.ejs gains an enable toggle, realm, and a username:password textarea
  (passwords never echoed back; blank keeps the current set).

Unit tests cover hashing (matches the htpasswd {SHA} vector), credential
parsing, and normalization. Note: the Lua path needs verification on a live
OpenResty box.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/models/host.js

@@ -41,6 +41,12 @@ class Host extends Table{
 		'ratelimit_burst': {default: 20, isRequired: false, type: 'number', min: 0, max: 1000000},
 		'respcache_enabled': {default: false, isRequired: false, type: 'boolean',},
 		'hsts_enabled': {default: false, isRequired: false, type: 'boolean',},
+		// Per-host HTTP basic auth. basicauth_users is {username: base64(sha1(pw))}
+		// (hashed at the route layer, see utils/basicauth.js); enforced in
+		// ops/nginx_conf/hostfeatures.lua.
+		'basicauth_enabled': {default: false, isRequired: false, type: 'boolean',},
+		'basicauth_realm': {default: 'Restricted', isRequired: false, type: 'string', min: 1, max: 128},
+		'basicauth_users': {default: function(){return {}}, isRequired: false, type: 'object',},
 		'req_headers': {default: function(){return {}}, isRequired: false, type: 'object',},
 		'resp_headers': {default: function(){return {}}, isRequired: false, type: 'object',},
 		'ip_allow': {default: function(){return []}, isRequired: false, type: 'object',},