JWT auth & registration

Email/password registration and login backed by bcrypt password hashing and JSON Web Tokens (JWT) for session state — the base authentication layer every other account feature builds on.

• You're standing up a new deployment and need the very first account
• You're building a client against POST /auth/register or /auth/login directly
• You want to understand what a session token contains before debugging a 401

POST /auth/register bcrypt-hashes the password and stores the user; POST /auth/login verifies it and issues a signed JWT (HS256, AUTH_SECRET_KEY) that the frontend keeps in authStore and attaches to subsequent API calls.