add auth system: users, login, JWT, protected routes

Domain: User entity, AuthPort/PasswordHashPort/SecretStore ports.
Adapters: auth (argon2 hashing, JWT tokens), secret-store (env-based),
config-sqlite user repository, http-api auth routes + extractors.
Application: auth_service. SPA: login page, auth client, protected router.

crates/domain/src/ports/auth.rs

@@ -0,0 +1,12 @@
+use crate::entities::UserId;
+use std::future::Future;
+
+pub trait AuthPort {
+    fn generate_token(&self, user_id: UserId) -> String;
+    fn validate_token(&self, token: &str) -> Option<UserId>;
+}
+
+pub trait PasswordHashPort {
+    fn hash(&self, plain: &str) -> impl Future<Output = Result<String, String>> + Send;
+    fn verify(&self, plain: &str, hash: &str) -> impl Future<Output = Result<bool, String>> + Send;
+}