feat: JWT auth, /api prefix, SPA serving, OpenAPI, lean main.rs

- auth: register/login/refresh/logout w/ JWT+Argon2, protected mutations
- domain: User, RefreshSession, auth ports, Unauthorized/Forbidden errors
- presentation: context/state/factory/errors/extractors/openapi modules
- routes behind /api, SPA served from root w/ fallback
- OpenAPI Scalar at /docs
- frontend ssr:false, single-binary Dockerfile

crates/presentation/Cargo.toml

@@ -9,10 +9,15 @@ tokio = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 uuid = { workspace = true }
+async-trait = { workspace = true }
+serde = { workspace = true }
 tower-http = { version = "0.6.8", features = ["cors", "fs", "trace", "tracing"] }
+utoipa = { version = "5", features = ["axum_extras"] }
+utoipa-scalar = { version = "0.3", features = ["axum"], default-features = false }
 
 api-types = { workspace = true }
 application = { workspace = true }
+auth = { workspace = true }
 domain = { workspace = true }
 infra-wiring = { workspace = true }
 sqlite = { workspace = true }