fix(auth): move tokens to memory from cache
A decently-sized token payload can become too large and overflow the
maximum cookie length. This caused our signins to fail silently with
newer Pocket ID versions, trapping us on the login screen.
This has been fixed by using BadgerDB as an in-memory token cache, and
changing the session token to being an encrypted version of the user's
Subject claim.