the foundation: where the instance is, and who is who on it

One Linkwarden per Officer install, pointed at by the owner, with every Officer
user mapped onto an account of their own. Officer stores no bookmarks; it owns
the credential and the door.

The model is Vault's, and the parts that are the same are the same on purpose:
a one-row config table rather than an env var, because a plugin cannot ask the
owner to edit a file and restart a process; a sidecar that is the only thing
knowing where the upstream is; and two doors, one authenticated for our own UI
and one unauthenticated for a client that carries its own credential.

`linkwarden_accounts` is the part Vault does not have. Its schema says so in as
many words - "mapping Officer accounts onto them is not a column here" - so this
is new work rather than a copy, and it follows plugins/USER_PROVISIONING.md,
written from the photos plugin against Immich.

── The difference that matters ──

Vaultwarden speaks a host-agnostic bearer protocol. Linkwarden is a Next.js app
using NextAuth, which issues host-scoped cookies, checks CSRF against the host,
and hands clients absolute URLs built from NEXTAUTH_URL. Measured rather than
inferred: a sign-in posted to the tailnet address answers with an absolute URL
to a hostname that does not answer at all.

So serving the extension through Officer needs NEXTAUTH_URL to name the address
Officer serves it at. That is a change to the container rather than to this
plugin, and it is a prerequisite, not a preference. The API half is unaffected -
/api/v1/* takes a bearer token and never touches NextAuth - so the panel and
anything an agent does work either way.

Verified against Linkwarden v2.16.2 on 2026-09-05: every route 401 without a
token and 200 with one, including /api/v1/users, which is the admin surface
provisioning needs. Links carry textContent and readable, which is what makes a
saved page searchable rather than merely re-openable.

Foundation only. No sidecar, routers, provisioning or panel yet.

.gitignore

@@ -0,0 +1,2 @@
+node_modules/
+*.log