Demo server was being deleted and recreated every time the lobby was
constructed, so it was always active. This rendered the "are we playing
a demo" checks useless as they always assumed we did. Logs didn't work
because of it, for example.

Construct the demo server only when the user selects demo playback, and
destroy it during the destruction of courtroom.

Make log_filename based on the application path, so `logs` subdirectory
is created relative to the executable rather than the working directory.

The subprotocol shall use binary frames, and AO protocol stays separated
within the text frames.

Introduce start_auth_flow, a function invoked by typing `/auth username`
in OOC. It sends an public-key authentication request to the server,
starting the entire flow.

The flow invoves two dialogs: to select the key, and to enter the
passphrase to unlock the key. For convenience, each successful unlock
also remembers the key for that username on the server, storing this
in `saved_auth.json` (I chose JSON because I wanted it to stay
human-editable; INI would be better, but it suffers from bad platform
quirks in Qt).

IL packet is a relic from pre-IPID days when moderators used it to get
the "IP list" of connected users.

Its function is to display a list of strings in the OOC chat box. That's
it. Not even some obscure feature that can be revived. Everything IL can
do, CT can do (the "OOC message" packet).

Strange idea, no realization. Trying to set up a "username requirement"
is antithetical to AO's pseudonymous nature. At least, CT packet is not
the way to do this: nothing guarantees its uniqueness, it's prone to
spoofing if we can send arbitrary CT messages at some point during the
handshake, and not everyone has their OOC names preconfigured.

It was never meant to be. Delete it.

This obscure feature has been present for years, from sending passwords
to the server to showing `char_passworded` image over character icons.

Servers could already exploit clients sending `PW` with a password every
time they select a character to implement passworded characters. The
clients had no way of knowing which ones were passworded, however, and
couldn't filter them despite "Passworded" checkbox being here all along.

The approach used by this commit is a hack. During loading, server sends
SC which is a list of characters, each one having name, description, and
evidence. In practice, only names were used. Descriptions were stored in
memory but unused, and evidence was ignored altogether. By adding a
magic value "P" in this "character evidence" field, server can mark
passworded characters without breaking Vanilla compatibility.

- fix RD being recorded twice
- fix demos recording themselves

* add song favoriting

* remove incorrectly placed sort()

* store as qstringlist instead of using keys