fix: account link proof by auth_time, code in the URL fragment and POST show

- BackendLinkConfirm reads the session's auth_time (bouncer.VerifyAuthTime);
  a token without it, or a refreshed old session, answers 409 stale_session
- POST /_user/api/v1/backend-link/show takes the code in the body; GET
  /backend-link/{code} stays, deprecated; both answer Cache-Control no-store
- My account answers <frontend_url><page_path>#code=<code>; new key
  golem15.user.backend_links.page_path (default /link-admin)
- TestBackendLink now crafts auth_time tokens; TestBackendLinkAuthTimeSmoke

config/config.yaml

@@ -38,10 +38,15 @@ privileged_groups:
 # refuses them. The turnstile:* middleware comes from the framework (summercms
 # v0.3.0 and later); its secret is turnstile.secret (SUMMER_TURNSTILE__SECRET).
 turnstile: ""
-# The site this plugin's links point to (the account link page
-# /link-admin?code=...). Empty falls back to app.url.
+# The site this plugin's links point to (the account link page,
+# <frontend_url><backend_links.page_path>#code=...). Empty falls back to
+# app.url.
 frontend_url: ""
 backend_links:
   # How long a link request an administrator starts on My account stays
   # usable (a Go duration). The code is one-shot.
   request_ttl: 10m
+  # The site page that confirms a link. My account sends the administrator
+  # to <frontend_url><page_path>#code=<code>; the code is in the fragment,
+  # which browsers never send to a server.
+  page_path: /link-admin