feat(sprint18): editor autosave/reset, admin auth, QR reuse, Ed25519 prep

- Project editor: persist draft to localStorage, restore on reload,
  last-saved/draft-restored status indicators, section/whole-draft reset
  with confirmation.
- Extract shared QR/polling/expiry engine from TelegramLoginComponent
  (shared/qr-login) and reuse it for a new admin login flow.
- Admin authentication kept fully separate from customer session:
  own cookie/localStorage keys, signals, guard, and header interceptor
  (core/admin-auth).
- ?login=true / ?adminLogin=true open the respective login dialog for
  manual testing.
- Ed25519 challenge/verify interfaces (fail-closed no-op binding) ready
  for backend delivery.
- Document autosave/reset/admin-auth/QR-reuse/Ed25519 model and the
  remaining full-field-coverage gap in docs/Project-Editor.md.

src/app/services/auth.service.ts

@@ -3,6 +3,7 @@ import { HttpClient } from '@angular/common/http';
 import { Observable, of, catchError, map, tap } from 'rxjs';
 import { AuthSession, AuthStatus, WebSessionStart } from '../models/auth.model';
 import { environment } from '../../environments/environment';
+import { generateGuid } from '../shared/util/guid.util';
 
 const WEB_SESSION_COOKIE = 'webSessionID';
 const WEB_SESSION_COOKIE_MAX_AGE_SECONDS = 60 * 60;
@@ -83,7 +84,7 @@ export class AuthService {
   }
 
   /** Generate the Telegram login URL for bot-based auth */
-  getTelegramLoginUrl(webSessionID = this.generateGuid()): string {
+  getTelegramLoginUrl(webSessionID = generateGuid()): string {
     const botUsername = this.getTelegramBotUsername();
     return `https://t.me/${botUsername}?start=${encodeURIComponent(webSessionID)}`;
   }
@@ -101,7 +102,7 @@ export class AuthService {
 
   /** Create a backend web session and return the Telegram start link for it. */
   createWebSession(): Observable<WebSessionStart> {
-    const webSessionID = this.generateGuid();
+    const webSessionID = generateGuid();
 
     return this.http.post<Record<string, unknown>>(
       `${this.authApiUrl}/users/sessions`,
@@ -297,27 +298,6 @@ export class AuthService {
     return ['true', '1', 'active', 'authenticated', 'confirmed', 'success', 'logged_in'].includes(status.toLowerCase());
   }
 
-  private generateGuid(): string {
-    if (globalThis.crypto?.randomUUID) {
-      return globalThis.crypto.randomUUID();
-    }
-
-    const bytes = new Uint8Array(16);
-    if (globalThis.crypto?.getRandomValues) {
-      globalThis.crypto.getRandomValues(bytes);
-    } else {
-      for (let index = 0; index < bytes.length; index++) {
-        bytes[index] = Math.floor(Math.random() * 256);
-      }
-    }
-
-    bytes[6] = (bytes[6] & 0x0f) | 0x40;
-    bytes[8] = (bytes[8] & 0x3f) | 0x80;
-
-    const hex = Array.from(bytes, byte => byte.toString(16).padStart(2, '0'));
-    return `${hex.slice(0, 4).join('')}-${hex.slice(4, 6).join('')}-${hex.slice(6, 8).join('')}-${hex.slice(8, 10).join('')}-${hex.slice(10, 16).join('')}`;
-  }
-
   private getStoredWebSessionID(): string | null {
     if (typeof document === 'undefined') {
       return null;