feat: protect write endpoints with JWT auth (story #08)

Add bcrypt user file auth, JWT middleware on all write routes, Pinia
authStore with localStorage persistence, login view with redirect
support, and v-if guards on all CRUD controls and admin nav link.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/stores/authStore.ts

@@ -0,0 +1,23 @@
+import { defineStore } from 'pinia'
+import { ref, computed } from 'vue'
+import { login as apiLogin } from '../api/auth'
+
+const TOKEN_KEY = 'auth_token'
+
+export const useAuthStore = defineStore('auth', () => {
+  const token = ref<string | null>(localStorage.getItem(TOKEN_KEY))
+  const isLoggedIn = computed(() => token.value !== null)
+
+  async function login(username: string, password: string) {
+    const resp = await apiLogin(username, password)
+    token.value = resp.token
+    localStorage.setItem(TOKEN_KEY, resp.token)
+  }
+
+  function logout() {
+    token.value = null
+    localStorage.removeItem(TOKEN_KEY)
+  }
+
+  return { token, isLoggedIn, login, logout }
+})