Block guest accounts from web UI login

The web UI now validates the MCIAS token after login and rejects
accounts with the guest role before setting the session cookie.
This is defense-in-depth alongside the env:restricted MCIAS tag.

The webserver.New() constructor takes a new ValidateFunc parameter
that inspects token roles post-authentication. MCIAS login does not
return roles, so this requires an extra ValidateToken round-trip at
login time (result is cached for 30s).

Security: guest role accounts are denied web UI access

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

RUNBOOK.md

@@ -15,7 +15,8 @@ MCR runs as two containers:
   token-based authentication via MCIAS.
 - **mcr-web** -- the web UI. Communicates with mcr-api via gRPC on port
   9443. Provides repository/tag browsing and ACL policy management for
-  administrators. Listens on port 8080.
+  administrators. Listens on port 8080. Guest accounts are blocked at
+  login; only `admin` and `user` roles can access the web interface.
 
 Both are fronted by MC-Proxy for TLS routing. Metadata is stored in
 SQLite; blobs are stored as content-addressed files on the filesystem