New Webserver and WebApp (#942)

* Replace the WCF webserver with an ASP.NET Core webserver (VocaluxeWeb)

- New project VocaluxeWeb: ASP.NET Core 2.3 (Kestrel) on .NET Framework 4.8.1, HTTP or HTTPS
  with a self-signed certificate, REST API (/api/v1) with Swagger, live events (Server-Sent Events)
- Access to the game only through IVocaluxeRemote; requests run on the main thread once per frame
- Sessions with roles (guest, player, admin) and configurable permissions, PINs hashed with PBKDF2
- Queue as a playlist with requesters and singers, fair order (one song per person and round)
- Admin: settings, server status, logged-in devices, activate/deactivate and delete profiles
- Profile pictures: own photo or one of the Vocaluxe avatars
- Game: WebApp queue screen (song options, playlist group) to start the next song with the chosen
  singers, return to it after singing, warning when the webserver is off, remote keyboard
- Old WCF server, WebserverInitalConfig and URL reservations removed; libraries moved to libs/managed
- Unit tests for PIN hashing, settings and permissions, queue order and device names
- AppVeyor: Visual Studio 2022 image and Node.js 24 (the build compiles the WebApp)
- Documentation in VocaluxeWeb/README.md

* New WebApp (Vue 3, TypeScript, Vite) replacing the old jQuery Mobile website

- Login with profile and PIN, create profiles
- Songs with search, filters, sorting and 30 second previews
- Queue: add songs with game mode, audio and singers, edit, reorder, start in the game
- Playlists: create, edit, add to the queue
- Now playing with live updates, remote control and keyboard
- Players: own profile with picture (photo or Vocaluxe avatar), roles for admins
- Admin settings: permissions, server status, devices, profiles
- Help page, responsive layout for phones, tablets and desktops, light and dark mode
- Texts in WebApp/src/locales/en.json, translated with Transifex
- Old website and PhoneGap config removed

---------

Co-authored-by: Florian Ostertag <flokuep@users.noreply.github.com>

VocaluxeWeb/Api/ApiControllerBase.cs

@@ -0,0 +1,119 @@
+#region license
+// This file is part of Vocaluxe.
+//
+// Vocaluxe is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Vocaluxe is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Vocaluxe. If not, see <http://www.gnu.org/licenses/>.
+#endregion
+
+using System;
+using System.Linq;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.Extensions.DependencyInjection;
+using VocaluxeWeb.Contracts;
+using VocaluxeWeb.Remote;
+using VocaluxeWeb.Services;
+
+namespace VocaluxeWeb.Api
+{
+    [ApiController]
+    [Produces("application/json")]
+    public abstract class ApiControllerBase : ControllerBase
+    {
+        internal const string SessionItemKey = "vlx.session";
+
+        /// The logged in session; set for actions with <see cref="RequireSessionAttribute" />.
+        protected CSession CurrentSession => HttpContext.Items[SessionItemKey] as CSession;
+
+        protected bool HasPermission(EPermission permission)
+        {
+            var session = CurrentSession;
+            var settings = HttpContext.RequestServices.GetRequiredService<CWebSettingsStore>().Current;
+            return session != null && settings.GetPermissions(session.Role).Contains(permission);
+        }
+
+        protected ObjectResult Problem(int status, string title)
+        {
+            return new ObjectResult(new ProblemDetails { Status = status, Title = title }) { StatusCode = status, ContentTypes = { "application/problem+json" } };
+        }
+
+        public static ProfileDto ToDto(RemoteProfile profile)
+        {
+            return new ProfileDto
+            {
+                Id = profile.Id,
+                Name = profile.Name,
+                Role = profile.Role,
+                HasPin = profile.PinHash != null,
+                HasAvatar = !string.IsNullOrEmpty(profile.AvatarPath),
+                Difficulty = profile.Difficulty,
+                IsActive = profile.IsActive
+            };
+        }
+    }
+
+    /// The request needs a logged in profile and, optionally, a permission. Admins have all permissions.
+    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
+    public sealed class RequireSessionAttribute : Attribute, IAuthorizationFilter
+    {
+        private readonly EPermission? _Permission;
+
+        public RequireSessionAttribute() { }
+
+        public RequireSessionAttribute(EPermission permission)
+        {
+            _Permission = permission;
+        }
+
+        public void OnAuthorization(AuthorizationFilterContext context)
+        {
+            var services = context.HttpContext.RequestServices;
+            var session = services.GetRequiredService<CSessionStore>().Get(context.HttpContext);
+            if (session == null)
+            {
+                context.Result = _Problem(StatusCodes.Status401Unauthorized, "Please log in.");
+                return;
+            }
+
+            context.HttpContext.Items[ApiControllerBase.SessionItemKey] = session;
+            if (_Permission.HasValue && !services.GetRequiredService<CWebSettingsStore>().Current.GetPermissions(session.Role).Contains(_Permission.Value))
+            {
+                context.Result = _Problem(StatusCodes.Status403Forbidden, "You are not allowed to do this.");
+            }
+        }
+
+        private static ObjectResult _Problem(int status, string title)
+        {
+            return new ObjectResult(new ProblemDetails { Status = status, Title = title }) { StatusCode = status, ContentTypes = { "application/problem+json" } };
+        }
+    }
+
+    /// Only admins.
+    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
+    public sealed class RequireAdminAttribute : Attribute, IAuthorizationFilter
+    {
+        public void OnAuthorization(AuthorizationFilterContext context)
+        {
+            var session = context.HttpContext.RequestServices.GetRequiredService<CSessionStore>().Get(context.HttpContext);
+            if (session == null || session.Role != ERemoteRole.Admin)
+            {
+                var status = session == null ? StatusCodes.Status401Unauthorized : StatusCodes.Status403Forbidden;
+                context.Result = new ObjectResult(new ProblemDetails { Status = status, Title = "Admins only." }) { StatusCode = status, ContentTypes = { "application/problem+json" } };
+                return;
+            }
+
+            context.HttpContext.Items[ApiControllerBase.SessionItemKey] = session;
+        }
+    }
+}