feat: JWT auth, /api prefix, SPA serving, OpenAPI, lean main.rs

- auth: register/login/refresh/logout w/ JWT+Argon2, protected mutations
- domain: User, RefreshSession, auth ports, Unauthorized/Forbidden errors
- presentation: context/state/factory/errors/extractors/openapi modules
- routes behind /api, SPA served from root w/ fallback
- OpenAPI Scalar at /docs
- frontend ssr:false, single-binary Dockerfile

crates/domain/src/lib.rs

@@ -6,12 +6,14 @@ pub mod value_objects;
 
 pub use errors::DomainError;
 pub use models::{
-    ChordPosition, LyricLine, Section, SectionKind, Song, SongMeta, SongSummary, StoredSong,
-    song_preview_chords,
+    ChordPosition, GeneratedToken, LyricLine, RefreshSession, Section, SectionKind, Song, SongMeta,
+    SongSummary, StoredSong, User, song_preview_chords,
 };
 pub use ports::{
-    FetchError, ParseError, SongRepositoryPort, SongSearchPort, TabFetcherPort, TabParserPort,
-    TabSource,
+    AuthService, FetchError, ParseError, PasswordHasher, RefreshSessionRepository,
+    SongRepositoryPort, SongSearchPort, TabFetcherPort, TabParserPort, TabSource, UserRepository,
 };
 pub use services::{ChordTransposer, TransposeError};
-pub use value_objects::{Chord, Note, SortField, SortOrder};
+pub use value_objects::{
+    Chord, Email, Note, Password, PasswordHash, SortField, SortOrder, UserId, Username,
+};