Local user identity UI

AuthGate already maps local authentication mode to canLogout=true. The shell should render the authenticated identity and its logout control only when authenticatedUser is present and canLogout is true. Upstream/Authentik and OIDC modes therefore hide both elements. Local authentication behavior remains unchanged.