Add sudo mode: step-up auth via Keycloak for dangerous actions

Dangerous actions now require re-authentication through Keycloak
before proceeding. The user is redirected to Keycloak with
max_age=0 and prompt=login, forcing a fresh password + 2FA check.

Protected actions:
- API token creation
- SSH key generation
- Repository deletion

Sudo mode lasts 5 minutes (cave_sudo cookie). Repeated dangerous
actions within the window don't re-prompt.

Flow:
1. User clicks dangerous action
2. Cave redirects to /-/sudo?next=<return-url>
3. Keycloak forces re-authentication
4. Callback sets cave_sudo cookie with timestamp
5. User is redirected back to complete the action

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>