Implemented phase 2 for the POC prototype in the Website service.

Services/Website/Sources/App/Extensions/App+Build.swift

@@ -70,6 +70,7 @@ func application(
             siteOrigin: reader.siteOrigin.isEmpty ? nil : reader.siteOrigin,
             logLevel: reader.logLevel,
             probe: Probe(fluent: fluent),
+            accounts: AccountRepository(fluent: fluent),
             repository: repository,
             listings: await homeListings(
                 from: repository,
@@ -182,6 +183,7 @@ private func logger(
 ///   - siteOrigin: the public origin the pages derive their canonical URLs and language alternates from, or `nil` to omit them.
 ///   - logLevel: the level the request-logging middleware logs at.
 ///   - probe: the probe consulted by the `HealthController` readiness route.
+///   - accounts: the repository the `SessionController` finds and creates accounts through.
 ///   - repository: the repository the `CatalogueController` reads the shops and listings through.
 ///   - listings: the listings the landing page shows in its rows.
 /// - Returns: the configured router.
@@ -197,6 +199,7 @@ private func router(
     siteOrigin: String?,
     logLevel: Logger.Level,
     probe: Probe,
+    accounts: AccountRepository,
     repository: CatalogueRepository,
     listings: HomeListings
 ) -> Router<AppRequestContext> {
@@ -206,6 +209,7 @@ private func router(
         context: AppRequestContext.self,
         options: .autoGenerateHeadEndpoints
     )
+    let sessions = SessionStore()
 
     router.addMiddleware {
         LogRequestsMiddleware(logLevel)
@@ -235,10 +239,21 @@ private func router(
             assetVersion: assetVersion,
             siteOrigin: siteOrigin,
             analytics: analytics,
-            listings: listings
+            listings: listings,
+            sessions: sessions
         )
         CatalogueController<AppRequestContext>(
             repository: repository,
+            sessions: sessions,
+            assetVersion: assetVersion,
+            analytics: analytics
+        )
+        SessionController<AppRequestContext>(
+            sessions: sessions,
+            accounts: accounts,
+            catalogue: repository,
+            // Limited to HTTPS wherever the site is served over it; plain-HTTP local development keeps the cookie usable.
+            isSecure: httpsRedirect.trustForwardedProto && httpsRedirect.origin.hasPrefix("https://"),
             assetVersion: assetVersion,
             analytics: analytics
         )