add auth system: users, login, JWT, protected routes

Domain: User entity, AuthPort/PasswordHashPort/SecretStore ports.
Adapters: auth (argon2 hashing, JWT tokens), secret-store (env-based),
config-sqlite user repository, http-api auth routes + extractors.
Application: auth_service. SPA: login page, auth client, protected router.

crates/application/tests/support/mod.rs

@@ -1,6 +1,6 @@
 use domain::{
     ConfigRepository, DataSource, DataSourceId, DomainEvent, EventPublisher, Layout, LayoutPreset,
-    LayoutPresetId, WidgetConfig, WidgetId,
+    LayoutPresetId, User, WidgetConfig, WidgetId,
 };
 use std::collections::HashMap;
 use std::sync::Mutex;
@@ -112,6 +112,18 @@ impl ConfigRepository for InMemoryConfigRepository {
         self.presets.lock().unwrap().remove(&id);
         Ok(())
     }
+
+    async fn get_user_by_username(&self, _username: &str) -> Result<Option<User>, Self::Error> {
+        Ok(None)
+    }
+
+    async fn save_user(&self, _user: &User) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    async fn count_users(&self) -> Result<u32, Self::Error> {
+        Ok(0)
+    }
 }
 
 pub struct InMemoryEventPublisher {