feat(api): add return_session login for cross-origin clients

Return the session token in the login response instead of a cookie, and accept it as a Bearer token without CSRF.

backend/src/Monitor.Backend.Api/Contracts/AdminDtos.cs

@@ -2,9 +2,10 @@ using System.Text.Json;
 
 namespace Monitor.Backend.Api;
 
-public sealed record LoginRequest(string Username, string Password);
+/// <summary><c>return_session</c>：跨域的前端用——不设 Cookie，把会话令牌放在响应里，之后用 <c>Authorization: Bearer</c> 带上。</summary>
+public sealed record LoginRequest(string Username, string Password, bool? ReturnSession);
 
-public sealed record LoginResponse(string UserId, string Username, string CsrfToken, DateTimeOffset ExpiresAt);
+public sealed record LoginResponse(string UserId, string Username, string CsrfToken, DateTimeOffset ExpiresAt, string? SessionToken);
 
 public sealed record MeDto(string Kind, string Scope, string? UserId, string? Username, string? CsrfToken);