feat(server): enable fxa oauth login + save to db


Fixes #40, almost-kinda-fixes #24.

Changes of note:
  * I'm able to do the complete oauth-driven login flow locally \o/
  * Remove jscs rule requiring a space after `function`
  * Serve static bits from `/dist`, not `/app`
  * Add mozlog logging: heka compatible in prod, yet readable for local dev

Particularly ugly/dangerous TODOs:
  * Added DB creation and DB client, (barely) functional yet so ugly
  * Make outgoing HTTP requests from inside the route handler: reverse proxy
    needed
  * Not yet using a nonce to avoid replay attacks, because hapi sessions
    are so &#$%! unnecessarily complicated

-----

r? @pdehaan && @seanmonstar && @nchapman 

I've got a super super hacky (yet working) front-end in my [issue-24-WIP](https://github.com/6a68/chronicle/tree/issue-24-WIP) branch; next I'll try to get a client-side commit together that works well enough with the code already in the repo.
```
  "duration": {
    "doc": "Default session TTL for authenticated users.",
    "format": "duration",
    "default": "7 days",
    "env": "SESSION_DURATION"
  }
```

convict supports moment.js-friendly dates. Plus then we can nuke the constant at the top of the page.