Introduce start_auth_flow, a function invoked by typing `/auth username`
in OOC. It sends an public-key authentication request to the server,
starting the entire flow.

The flow invoves two dialogs: to select the key, and to enter the
passphrase to unlock the key. For convenience, each successful unlock
also remembers the key for that username on the server, storing this
in `saved_auth.json` (I chose JSON because I wanted it to stay
human-editable; INI would be better, but it suffers from bad platform
quirks in Qt).

IL packet is a relic from pre-IPID days when moderators used it to get
the "IP list" of connected users.

Its function is to display a list of strings in the OOC chat box. That's
it. Not even some obscure feature that can be revived. Everything IL can
do, CT can do (the "OOC message" packet).

We have SP and JD to precisely handle positions and judge buttons.

- For QCheckBox: stateChanged -> checkStateChanged

- QChar(PREANIM) -> QLatin1Char(PREANIM)

- Unused result on demo_file.open()

- QPointer include was missing from lobby.h

- Missing const and override qualifiers

Instead of waiting for the incoming message and checking that you've
sent it by comparing character IDs, reset it right away after pressing
Enter.

From the network standpoint, there's no reason to wait and acknowledge
the IC message this way because TCP already ensures reliabile delivery.

Removing this avoids sending duplicate messages during lag spikes. It
also subjectively improves responsiveness.

We lose a bit of convenience. The text box will be cleared even if your
message was never broadcast (due to serverside mute, for example), but
Ctrl+Z fixes that, and that's how OOC chat has always worked.

Server already gives the response to our authentication atttempt,
there's no need for CLIENT to tell us about the "Disable Modcalls"
button (which is actually labeled "Guard").

This fixes "Reload theme" button resetting position.

This obscure feature has been present for years, from sending passwords
to the server to showing `char_passworded` image over character icons.

Servers could already exploit clients sending `PW` with a password every
time they select a character to implement passworded characters. The
clients had no way of knowing which ones were passworded, however, and
couldn't filter them despite "Passworded" checkbox being here all along.

The approach used by this commit is a hack. During loading, server sends
SC which is a list of characters, each one having name, description, and
evidence. In practice, only names were used. Descriptions were stored in
memory but unused, and evidence was ignored altogether. By adding a
magic value "P" in this "character evidence" field, server can mark
passworded characters without breaking Vanilla compatibility.

Presenting evidence took volume as a parameter which it also set. It's
unnecessary as the evidence uses the same SFX player, the volume of
which is controlled by the player with a slider.