feat(api): add return_session login for cross-origin clients

Return the session token in the login response instead of a cookie, and accept it as a Bearer token without CSRF.

backend/openapi/v1.json

@@ -5146,7 +5146,8 @@
       "LoginRequest": {
         "required": [
           "username",
-          "password"
+          "password",
+          "return_session"
         ],
         "type": "object",
         "properties": {
@@ -5155,6 +5156,12 @@
           },
           "password": {
             "type": "string"
+          },
+          "return_session": {
+            "type": [
+              "null",
+              "boolean"
+            ]
           }
         }
       },
@@ -5163,7 +5170,8 @@
           "user_id",
           "username",
           "csrf_token",
-          "expires_at"
+          "expires_at",
+          "session_token"
         ],
         "type": "object",
         "properties": {
@@ -5178,6 +5186,12 @@
           },
           "expires_at": {
             "format": "date-time"
+          },
+          "session_token": {
+            "type": [
+              "null",
+              "string"
+            ]
           }
         }
       },