Shared engine for dsh-plugin-ops: profile readers, scan rules, fault memory, fix planner, panel API

Login gate for DeepSeek Harness (dsh) web instances: password or shared-token sign-in, optional TOTP two-factor, session cookies, rate limiting, self-service password change and a user-management CLI