add auth system: users, login, JWT, protected routes

Domain: User entity, AuthPort/PasswordHashPort/SecretStore ports.
Adapters: auth (argon2 hashing, JWT tokens), secret-store (env-based),
config-sqlite user repository, http-api auth routes + extractors.
Application: auth_service. SPA: login page, auth client, protected router.

crates/domain/src/lib.rs

@@ -7,12 +7,12 @@ pub mod value_objects;
 
 pub use entities::{
     DataSource, DataSourceConfig, DataSourceId, DataSourceType, DataSourceValidationError,
-    LayoutPreset, LayoutPresetId, WidgetConfig, WidgetId,
+    LayoutPreset, LayoutPresetId, User, UserId, WidgetConfig, WidgetId,
 };
 pub use events::DomainEvent;
 pub use ports::{
-    BroadcastPort, ClientRegistry, ConfigRepository, ConnectedClient, DataSourcePort,
-    EventPublisher, WidgetStateReader,
+    AuthPort, BroadcastPort, ClientRegistry, ConfigRepository, ConnectedClient, DataSourcePort,
+    EventPublisher, PasswordHashPort, SecretStore, WidgetStateReader,
 };
 pub use value_objects::{
     ContainerNode, Direction, DisplayHint, KeyMapping, Layout, LayoutChild, LayoutNode,