Remove firebase/auth from clients, use our own APIs instead

[andymatuschak]

I'd like to compartmentalize Firebase as much as possible. Right now, the only significant remaining "leakage" of our usage to clients is firebase/auth, which we use to sign in, persist credentials, etc. We should instead make requests against our own backend APIs, which can call the appropriate Firebase APIs. This will save bundle size (that library is huge!), but it'll also make it easier when we eventually make self-hosting variants, etc.

Bonus points for migrating existing users' stored firebase/auth credentials to whatever new persistence scheme we implement.