feat: JWT auth, /api prefix, SPA serving, OpenAPI, lean main.rs

- auth: register/login/refresh/logout w/ JWT+Argon2, protected mutations
- domain: User, RefreshSession, auth ports, Unauthorized/Forbidden errors
- presentation: context/state/factory/errors/extractors/openapi modules
- routes behind /api, SPA served from root w/ fallback
- OpenAPI Scalar at /docs
- frontend ssr:false, single-binary Dockerfile

Dockerfile

@@ -1,29 +1,35 @@
-FROM rust:1.97 AS builder
+FROM node:22-slim AS frontend
+
+WORKDIR /app/frontend
+COPY app/package.json app/package-lock.json ./
+RUN npm ci
+COPY app/ .
+ENV VITE_API_URL=/api
+RUN npm run build
+
+FROM rust:1.97 AS backend
 
 WORKDIR /app
 COPY . .
-
-# Build the release binary
 RUN cargo build --release -p presentation
 
 FROM debian:trixie-slim
 
 WORKDIR /app
 
-# Install OpenSSL, CA certs
 RUN apt-get update && apt-get install -y --no-install-recommends \
     libssl3 \
     ca-certificates \
     libsqlite3-0 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --from=builder /app/target/release/presentation .
+COPY --from=backend /app/target/release/presentation .
+COPY --from=frontend /app/frontend/build/client ./spa
 
-
-# Create data directory for SQLite
 RUN mkdir -p /app/data
 
 ENV DATABASE_URL=sqlite:///app/data/pocket-chords.db
+ENV SPA_DIR=/app/spa
 
 EXPOSE 8000