Tamper owner PWA

Sign in before the rush.

JWTs are stored in httpOnly cookies. Demo alpha uses owner@tamper.local / tamper-alpha when no backend URL is configured.