Authc: Local users and sessions (proposal required, deferred)

## Status

This issue is proposal-first and currently deferred.

Based on the maintainer discussion, third-party login should be considered before local controller-managed users. Local users should be treated as a possible fallback or lightweight testing feature after the first authentication direction is agreed.

## Goal

Explore whether and how Kvrocks Controller should support controller-managed local users and sessions.

This issue is intentionally not a ready-to-code implementation plan. Contributors should design the approach first.

## Proposal Required

Before opening an implementation PR, please post a proposal in this issue and wait for maintainer agreement.

The proposal should cover at least:

- Why local users are needed and how they coexist with third-party login or gateway authentication.
- The intended user model and role model at a high level.
- The session or token model, including storage and expiration behavior across controller instances.
- The expected API and Web UI surface.
- Configuration changes and backward compatibility when authentication is disabled.
- Security considerations and the planned test coverage.

## Notes

Local users, if accepted, are intended for testing and lightweight development use unless maintainers agree on a broader production scope.

Detailed implementation steps should be proposed by the contributor and reviewed by maintainers before development starts.