New Webserver and WebApp (#942)

* Replace the WCF webserver with an ASP.NET Core webserver (VocaluxeWeb)

- New project VocaluxeWeb: ASP.NET Core 2.3 (Kestrel) on .NET Framework 4.8.1, HTTP or HTTPS
  with a self-signed certificate, REST API (/api/v1) with Swagger, live events (Server-Sent Events)
- Access to the game only through IVocaluxeRemote; requests run on the main thread once per frame
- Sessions with roles (guest, player, admin) and configurable permissions, PINs hashed with PBKDF2
- Queue as a playlist with requesters and singers, fair order (one song per person and round)
- Admin: settings, server status, logged-in devices, activate/deactivate and delete profiles
- Profile pictures: own photo or one of the Vocaluxe avatars
- Game: WebApp queue screen (song options, playlist group) to start the next song with the chosen
  singers, return to it after singing, warning when the webserver is off, remote keyboard
- Old WCF server, WebserverInitalConfig and URL reservations removed; libraries moved to libs/managed
- Unit tests for PIN hashing, settings and permissions, queue order and device names
- AppVeyor: Visual Studio 2022 image and Node.js 24 (the build compiles the WebApp)
- Documentation in VocaluxeWeb/README.md

* New WebApp (Vue 3, TypeScript, Vite) replacing the old jQuery Mobile website

- Login with profile and PIN, create profiles
- Songs with search, filters, sorting and 30 second previews
- Queue: add songs with game mode, audio and singers, edit, reorder, start in the game
- Playlists: create, edit, add to the queue
- Now playing with live updates, remote control and keyboard
- Players: own profile with picture (photo or Vocaluxe avatar), roles for admins
- Admin settings: permissions, server status, devices, profiles
- Help page, responsive layout for phones, tablets and desktops, light and dark mode
- Texts in WebApp/src/locales/en.json, translated with Transifex
- Old website and PhoneGap config removed

---------

Co-authored-by: Florian Ostertag <flokuep@users.noreply.github.com>

VocaluxeWeb/Services/CPinHasher.cs

@@ -0,0 +1,95 @@
+#region license
+// This file is part of Vocaluxe.
+//
+// Vocaluxe is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Vocaluxe is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Vocaluxe. If not, see <http://www.gnu.org/licenses/>.
+#endregion
+
+using System.Security.Cryptography;
+using System.Text;
+
+namespace VocaluxeWeb.Services
+{
+    /// PINs are hashed with PBKDF2 (16 byte salt). Profiles from the old webserver use a single salted SHA-256 (32 byte salt);
+    /// those are still accepted and upgraded on the next successful login.
+    public static class CPinHasher
+    {
+        private const int _SaltSize = 16;
+        private const int _LegacySaltSize = 32;
+        private const int _HashSize = 32;
+        private const int _Iterations = 100000;
+
+        public static void Hash(string pin, out byte[] hash, out byte[] salt)
+        {
+            salt = new byte[_SaltSize];
+            using (var rng = RandomNumberGenerator.Create())
+            {
+                rng.GetBytes(salt);
+            }
+
+            hash = _Pbkdf2(pin, salt);
+        }
+
+        public static bool Verify(string pin, byte[] hash, byte[] salt)
+        {
+            if (hash == null || salt == null || pin == null)
+            {
+                return false;
+            }
+
+            var computed = salt.Length == _LegacySaltSize ? _LegacySha256(pin, salt) : _Pbkdf2(pin, salt);
+            return _FixedTimeEquals(computed, hash);
+        }
+
+        public static bool NeedsUpgrade(byte[] salt)
+        {
+            return salt != null && salt.Length == _LegacySaltSize;
+        }
+
+        private static byte[] _Pbkdf2(string pin, byte[] salt)
+        {
+            using (var kdf = new Rfc2898DeriveBytes(pin, salt, _Iterations, HashAlgorithmName.SHA256))
+            {
+                return kdf.GetBytes(_HashSize);
+            }
+        }
+
+        private static byte[] _LegacySha256(string pin, byte[] salt)
+        {
+            var password = Encoding.UTF8.GetBytes(pin);
+            var data = new byte[password.Length + salt.Length];
+            password.CopyTo(data, 0);
+            salt.CopyTo(data, password.Length);
+            using (var sha = SHA256.Create())
+            {
+                return sha.ComputeHash(data);
+            }
+        }
+
+        private static bool _FixedTimeEquals(byte[] a, byte[] b)
+        {
+            if (a.Length != b.Length)
+            {
+                return false;
+            }
+
+            var diff = 0;
+            for (var i = 0; i < a.Length; i++)
+            {
+                diff |= a[i] ^ b[i];
+            }
+
+            return diff == 0;
+        }
+    }
+}