feat: JWT auth, /api prefix, SPA serving, OpenAPI, lean main.rs

- auth: register/login/refresh/logout w/ JWT+Argon2, protected mutations
- domain: User, RefreshSession, auth ports, Unauthorized/Forbidden errors
- presentation: context/state/factory/errors/extractors/openapi modules
- routes behind /api, SPA served from root w/ fallback
- OpenAPI Scalar at /docs
- frontend ssr:false, single-binary Dockerfile

crates/application/src/auth/deps.rs

@@ -0,0 +1,27 @@
+use std::sync::Arc;
+
+use domain::ports::{AuthService, PasswordHasher, RefreshSessionRepository, UserRepository};
+
+pub struct RegisterDeps {
+    pub user_repo: Arc<dyn UserRepository>,
+    pub password_hasher: Arc<dyn PasswordHasher>,
+    pub allow_registration: bool,
+}
+
+pub struct LoginDeps {
+    pub user_repo: Arc<dyn UserRepository>,
+    pub password_hasher: Arc<dyn PasswordHasher>,
+    pub auth_service: Arc<dyn AuthService>,
+    pub refresh_repo: Arc<dyn RefreshSessionRepository>,
+    pub refresh_ttl_seconds: u64,
+}
+
+pub struct RefreshDeps {
+    pub auth_service: Arc<dyn AuthService>,
+    pub refresh_repo: Arc<dyn RefreshSessionRepository>,
+    pub refresh_ttl_seconds: u64,
+}
+
+pub struct LogoutDeps {
+    pub refresh_repo: Arc<dyn RefreshSessionRepository>,
+}