feat: protect write endpoints with JWT auth (story #08)

Add bcrypt user file auth, JWT middleware on all write routes, Pinia
authStore with localStorage persistence, login view with redirect
support, and v-if guards on all CRUD controls and admin nav link.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/cmd/server/main.go

@@ -10,6 +10,7 @@ import (
 	"syscall"
 	"time"
 
+	"osdb/internal/auth"
 	"osdb/internal/config"
 	"osdb/internal/database"
 	"osdb/internal/migrate"
@@ -52,7 +53,13 @@ func serve(cfg *config.Config) {
 	defer pool.Close()
 	log.Println("database: connected")
 
-	e := New(pool)
+	users, err := auth.LoadUsers(cfg.UsersFile)
+	if err != nil {
+		log.Fatalf("auth: load users from %s: %v", cfg.UsersFile, err)
+	}
+	log.Printf("auth: loaded %d user(s)", len(users))
+
+	e := New(pool, users, cfg.JWTSecret)
 
 	// Start server; signal failures via a channel so the main goroutine can
 	// handle them without calling os.Exit from a goroutine (which would skip