add auth system: users, login, JWT, protected routes

Domain: User entity, AuthPort/PasswordHashPort/SecretStore ports.
Adapters: auth (argon2 hashing, JWT tokens), secret-store (env-based),
config-sqlite user repository, http-api auth routes + extractors.
Application: auth_service. SPA: login page, auth client, protected router.

crates/adapters/http-api/src/routes/clients.rs

@@ -1,12 +1,16 @@
 use crate::AppState;
+use crate::extractors::AuthUser;
 use api_types::ClientDto;
 use axum::extract::State;
 use axum::response::Json;
 use domain::{ClientRegistry, ConfigRepository, EventPublisher};
 
-type S<C, E, W, B, R> = State<AppState<C, E, W, B, R>>;
+type S<C, E, W, B, R, A, H> = State<AppState<C, E, W, B, R, A, H>>;
 
-pub async fn list_clients<C, E, W, B, R>(State(state): S<C, E, W, B, R>) -> Json<Vec<ClientDto>>
+pub async fn list_clients<C, E, W, B, R, A, H>(
+    _auth: AuthUser,
+    State(state): S<C, E, W, B, R, A, H>,
+) -> Json<Vec<ClientDto>>
 where
     C: ConfigRepository,
     C::Error: std::fmt::Debug,