add auth system: users, login, JWT, protected routes

Domain: User entity, AuthPort/PasswordHashPort/SecretStore ports.
Adapters: auth (argon2 hashing, JWT tokens), secret-store (env-based),
config-sqlite user repository, http-api auth routes + extractors.
Application: auth_service. SPA: login page, auth client, protected router.

Cargo.toml

@@ -14,6 +14,8 @@ members = [
     "crates/adapters/http-json",
     "crates/adapters/rss",
     "crates/adapters/media",
+    "crates/adapters/auth",
+    "crates/adapters/secret-store",
     "crates/api-types",
     "crates/bootstrap",
     "crates/client-desktop",
@@ -38,6 +40,8 @@ http-json = { path = "crates/adapters/http-json" }
 http-api = { path = "crates/adapters/http-api" }
 media-adapter = { path = "crates/adapters/media" }
 rss-adapter = { path = "crates/adapters/rss" }
+kframe-auth = { path = "crates/adapters/auth" }
+secret-store = { path = "crates/adapters/secret-store" }
 axum = { version = "0.8", features = ["macros"] }
 tower-http = { version = "0.6", features = ["cors", "fs"] }
 api-types = { path = "crates/api-types" }