Add readonly and disabled to offer and wishlist pages so user only allowed to change in certain state

Add modify time to offer and wishlist table, added StateCityLookupModel and Repository. added StateCodeEnum in utility package

now server can create login cookie and client can store cookie in broser. We use userId as token for login cookie for convinence for now.

2. server return session token with Usermodel after successfully login -> store login status in vuex
3. add log out button -> clear token in localstorage and login status in vuex
4. now we can define each route whether it needs auth (login status) to continue redirecting

This reverts commit 3cd1047a.

But ref<FormInstance> has problem, need to check.