The server no longer stores user accounts. PIHTTPServerMultiUser is renamed to
PIHTTPServerSessionAuth and keeps only the in-memory session table: credential
verification is delegated to the pure virtual checkCredentials(), implemented by
a client subclass that owns the user storage.
- remove UserRec, addUser/removeUser/userExists/userCount and the password
check callback; add protected revokeToken()/revokeUserTokens() helpers
- add configurable login/logout route paths (default /api/login, /api/logout)
- call checkCredentials() without holding the internal lock and report 500 when
the token generator yields no data
- rewrite tests around a client subclass with its own user table
