oauth login

right now, the client just uses password authentication to login. It might be a better idea to disallow password authentication for applications, and only allow oauth login i.e. the shoot server has a small embedded login form that it serves and clients just redirect to that, like how mastodon clients do for example

Start by locating the current password-authentication flow in the client and shoot server. Review how the server could serve an embedded login form and how clients would redirect back, using Mastodon clients as the stated reference. Done means password authentication for applications is disallowed and the OAuth login flow works end to end.

Written by the indexing model from the issue text.