feat: auth hardening + codebase quality sweep

Refresh tokens: RefreshToken entity, PostgresRefreshTokenRepository,
login returns refresh token, POST /auth/refresh (rotation), POST /auth/logout,
JWT expiry 24h→1h, configurable via with_expiry().

Route protection: require_auth middleware on protected routes,
public routes split (register, login, refresh, sharing/access).

Authorization: caller_id added to ReadAssetFileQuery, ReadDerivativeQuery,
GetStackQuery, DeleteStackCommand with ownership checks. Admin-only gates
on processing, storage, sidecar, duplicates handlers.

Quality fixes: visibility filtering bypass in search(), unwrap panics in
date parsing, DRY auth header parsing, centralized parsers module,
email validation via email_address crate, value objects (Username, MimeType,
RelativePath), domain events (UserCreated, UserDeleted, AlbumCreated,
TagCreated, DuplicateDetected), postgres error mapping for constraint
violations, OptionExt::or_not_found helper, in_memory_repo! macro,
GetStackQuery moved to queries, album add_entry 200→201.

crates/api-types/src/requests.rs

@@ -11,6 +11,11 @@ pub struct LoginRequest {
     pub password: String,
 }
 
+#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
+pub struct RefreshTokenRequest {
+    pub refresh_token: String,
+}
+
 #[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
 pub struct CreateAlbumRequest {
     pub title: String,
@@ -86,6 +91,28 @@ pub struct RegisterAssetRequest {
     pub file_size: u64,
 }
 
+// --- Stacks ---
+
+#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
+pub struct CreateStackRequest {
+    pub stack_type: String,
+    pub primary_asset_id: uuid::Uuid,
+    pub members: Vec<StackMemberRequest>,
+}
+
+#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
+pub struct StackMemberRequest {
+    pub asset_id: uuid::Uuid,
+    pub role: String,
+}
+
+// --- Duplicates ---
+
+#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
+pub struct ResolveDuplicateRequest {
+    pub keep_asset_id: uuid::Uuid,
+}
+
 // --- Sidecar ---
 
 #[derive(Debug, serde::Deserialize, utoipa::ToSchema)]

crates/api-types/src/responses.rs

@@ -12,6 +12,7 @@ pub struct UserResponse {
 #[derive(Debug, serde::Serialize, utoipa::ToSchema)]
 pub struct AuthResponse {
     pub token: String,
+    pub refresh_token: String,
     pub user: UserResponse,
 }
 
@@ -267,6 +268,78 @@ pub struct SidecarImportResponse {
     pub status: String,
 }
 
+// --- Stacks ---
+
+#[derive(Debug, serde::Serialize, utoipa::ToSchema)]
+pub struct StackResponse {
+    pub stack_id: Uuid,
+    pub stack_type: String,
+    pub primary_asset_id: Uuid,
+    pub owner_user_id: Uuid,
+    pub members: Vec<StackMemberResponse>,
+}
+
+#[derive(Debug, serde::Serialize, utoipa::ToSchema)]
+pub struct StackMemberResponse {
+    pub asset_id: Uuid,
+    pub role: String,
+    pub sort_order: u32,
+}
+
+impl StackResponse {
+    pub fn from_domain(stack: &domain::entities::AssetStack) -> Self {
+        Self {
+            stack_id: *stack.stack_id.as_uuid(),
+            stack_type: format!("{:?}", stack.stack_type),
+            primary_asset_id: *stack.primary_asset_id.as_uuid(),
+            owner_user_id: *stack.owner_user_id.as_uuid(),
+            members: stack
+                .members
+                .iter()
+                .map(|m| StackMemberResponse {
+                    asset_id: *m.asset_id.as_uuid(),
+                    role: format!("{:?}", m.role),
+                    sort_order: m.sort_order,
+                })
+                .collect(),
+        }
+    }
+}
+
+// --- Duplicates ---
+
+#[derive(Debug, serde::Serialize, utoipa::ToSchema)]
+pub struct DuplicateGroupResponse {
+    pub group_id: Uuid,
+    pub detection_method: String,
+    pub status: String,
+    pub candidates: Vec<DuplicateCandidateResponse>,
+}
+
+#[derive(Debug, serde::Serialize, utoipa::ToSchema)]
+pub struct DuplicateCandidateResponse {
+    pub asset_id: Uuid,
+    pub similarity_score: f64,
+}
+
+impl DuplicateGroupResponse {
+    pub fn from_domain(group: &domain::entities::DuplicateGroup) -> Self {
+        Self {
+            group_id: *group.group_id.as_uuid(),
+            detection_method: format!("{:?}", group.detection_method),
+            status: format!("{:?}", group.status),
+            candidates: group
+                .candidates
+                .iter()
+                .map(|c| DuplicateCandidateResponse {
+                    asset_id: *c.asset_id.as_uuid(),
+                    similarity_score: c.similarity_score,
+                })
+                .collect(),
+        }
+    }
+}
+
 // --- Processing ---
 
 #[derive(Debug, serde::Serialize, utoipa::ToSchema)]
@@ -290,6 +363,12 @@ impl JobResponse {
     }
 }
 
+#[derive(Debug, serde::Serialize, utoipa::ToSchema)]
+pub struct JobListResponse {
+    pub jobs: Vec<JobResponse>,
+    pub total: u64,
+}
+
 #[derive(Debug, serde::Serialize, utoipa::ToSchema)]
 pub struct BatchProgressResponse {
     pub batch_id: Uuid,