Railbase core v0.5.18

Site frontend + auth improvements.

• Signed-in site sidebar — a persistent left nav (Home + each installed plugin's page + account/sign-out) wraps the site shell; new plugin installs appear with no rebuild.
• Hardened signup form — password strength meter + generator + confirm field, validated against the shared policy (≥8 + upper + digit + symbol).
• Optional email-verification gate (operator setting, default off) — when enabled, signup withholds the session and emails a confirm link; unverified sign-ins are blocked with a one-click resend. Toggle in admin → Auth methods.
• Global 401 recovery — a stale token now clears + signs out cleanly instead of looping (fixes the /translate 401 loop).

All binaries pin the railbase.app vendor trust root. Verify downloads against checksums.txt.