feat: JWT auth, /api prefix, SPA serving, OpenAPI, lean main.rs

- auth: register/login/refresh/logout w/ JWT+Argon2, protected mutations
- domain: User, RefreshSession, auth ports, Unauthorized/Forbidden errors
- presentation: context/state/factory/errors/extractors/openapi modules
- routes behind /api, SPA served from root w/ fallback
- OpenAPI Scalar at /docs
- frontend ssr:false, single-binary Dockerfile

crates/application/src/auth/logout.rs

@@ -0,0 +1,8 @@
+use domain::errors::DomainError;
+
+use super::commands::LogoutCommand;
+use super::deps::LogoutDeps;
+
+pub async fn execute(deps: &LogoutDeps, cmd: LogoutCommand) -> Result<(), DomainError> {
+    deps.refresh_repo.revoke(&cmd.refresh_token).await
+}