db&webapi, primitive session tokens

adds a temporary auth method to users which does not require a password
or similar. This is just for testing right now and assumes a self-hosted
no-threats environment.

Also adds a user_key state to keep track of authed users. These
currently *DO NOT EXPIRE* which is pretty bad haha. The entire auth
system will be redone.

koucha/src/bin/webapi/routes/mod.rs

@@ -11,6 +11,7 @@ use axum::{
 };
 use reqwest::StatusCode;
 
+mod create_session;
 mod get_users;
 mod new_user;
 
@@ -28,6 +29,7 @@ pub struct ApiError {
 
 pub fn router() -> Router<AppState> {
   Router::new()
+    .route("/create_session", post(create_session::handler))
     .route("/get_users", get(get_users::handler))
     .route("/new_user", post(new_user::handler))
 }