feat: auth hardening + codebase quality sweep

Refresh tokens: RefreshToken entity, PostgresRefreshTokenRepository,
login returns refresh token, POST /auth/refresh (rotation), POST /auth/logout,
JWT expiry 24h→1h, configurable via with_expiry().

Route protection: require_auth middleware on protected routes,
public routes split (register, login, refresh, sharing/access).

Authorization: caller_id added to ReadAssetFileQuery, ReadDerivativeQuery,
GetStackQuery, DeleteStackCommand with ownership checks. Admin-only gates
on processing, storage, sidecar, duplicates handlers.

Quality fixes: visibility filtering bypass in search(), unwrap panics in
date parsing, DRY auth header parsing, centralized parsers module,
email validation via email_address crate, value objects (Username, MimeType,
RelativePath), domain events (UserCreated, UserDeleted, AlbumCreated,
TagCreated, DuplicateDetected), postgres error mapping for constraint
violations, OptionExt::or_not_found helper, in_memory_repo! macro,
GetStackQuery moved to queries, album add_entry 200→201.

crates/bootstrap/src/services/processing.rs

@@ -6,7 +6,7 @@ use adapters_postgres::{
 };
 use application::processing::{
     CompleteJobHandler, ConfigurePipelineHandler, EnqueueJobHandler, FailJobHandler,
-    ManagePluginHandler, ReportBatchProgressHandler, StartJobHandler,
+    ListJobsHandler, ManagePluginHandler, ReportBatchProgressHandler, StartJobHandler,
 };
 use domain::ports::EventPublisher;
 use presentation::state::ProcessingHandlers;
@@ -32,6 +32,7 @@ pub fn build(pool: &PgPool, event_publisher: Arc<dyn EventPublisher>) -> Process
         batch_repo.clone(),
         event_publisher,
     ));
+    let list_jobs = Arc::new(ListJobsHandler::new(job_repo.clone()));
     let batch_progress = Arc::new(ReportBatchProgressHandler::new(batch_repo, job_repo));
     let manage_plugin = Arc::new(ManagePluginHandler::new(plugin_repo.clone()));
     let configure_pipeline = Arc::new(ConfigurePipelineHandler::new(pipeline_repo, plugin_repo));
@@ -41,6 +42,7 @@ pub fn build(pool: &PgPool, event_publisher: Arc<dyn EventPublisher>) -> Process
         start_job,
         complete_job,
         fail_job,
+        list_jobs,
         batch_progress,
         manage_plugin,
         configure_pipeline,