feat: JWT auth, /api prefix, SPA serving, OpenAPI, lean main.rs

- auth: register/login/refresh/logout w/ JWT+Argon2, protected mutations
- domain: User, RefreshSession, auth ports, Unauthorized/Forbidden errors
- presentation: context/state/factory/errors/extractors/openapi modules
- routes behind /api, SPA served from root w/ fallback
- OpenAPI Scalar at /docs
- frontend ssr:false, single-binary Dockerfile

Cargo.toml

@@ -1,5 +1,6 @@
 [workspace]
 members = [
+    "crates/adapters/auth",
     "crates/adapters/sqlite",
     "crates/adapters/ug-parser",
     "crates/api-types",
@@ -30,6 +31,7 @@ domain = { path = "crates/domain" }
 application = { path = "crates/application" }
 api-types = { path = "crates/api-types" }
 infra-wiring = { path = "crates/infra-wiring" }
+auth = { path = "crates/adapters/auth" }
 sqlite = { path = "crates/adapters/sqlite" }
 ug-parser = { path = "crates/adapters/ug-parser" }