Within hours of posting this, the problem spread to every mac on my network, no one could log in anywhere.
I rebooted the mini and the problem went away.
I'm not finding problems in the server log, but it's possible I'm looking in the wrong places. I just can't comprehend why I could authenticate SSH but not graphical login.
The server was at not quite two weeks of uptime which is disappointing. "just reboot it" seems like a Windows solution.