feat: JWT auth, /api prefix, SPA serving, OpenAPI, lean main.rs

- auth: register/login/refresh/logout w/ JWT+Argon2, protected mutations
- domain: User, RefreshSession, auth ports, Unauthorized/Forbidden errors
- presentation: context/state/factory/errors/extractors/openapi modules
- routes behind /api, SPA served from root w/ fallback
- OpenAPI Scalar at /docs
- frontend ssr:false, single-binary Dockerfile

crates/domain/src/value_objects/mod.rs

@@ -1,7 +1,11 @@
 mod chord;
+mod ids;
 mod note;
 mod sorting;
+mod user;
 
 pub use chord::*;
+pub use ids::*;
 pub use note::*;
 pub use sorting::*;
+pub use user::*;