feat: protect write endpoints with JWT auth (story #08)

Add bcrypt user file auth, JWT middleware on all write routes, Pinia
authStore with localStorage persistence, login view with redirect
support, and v-if guards on all CRUD controls and admin nav link.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/create_user.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Usage: ./scripts/create_user.sh <username> <password>
+# Prints a line suitable for appending to users.env
+set -euo pipefail
+
+if [ $# -ne 2 ]; then
+  echo "Usage: $0 <username> <password>" >&2
+  exit 1
+fi
+
+USERNAME="$1"
+PASSWORD="$2"
+
+# bcrypt the peppered input "username:password"
+PEPPERED="${USERNAME}:${PASSWORD}"
+
+# Try Python 3 with bcrypt first, then fall back to htpasswd
+if python3 -c "import bcrypt" 2>/dev/null; then
+  HASH=$(python3 -c "
+import bcrypt, sys
+pw = sys.argv[1].encode()
+print(bcrypt.hashpw(pw, bcrypt.gensalt(rounds=12)).decode())
+" "$PEPPERED")
+elif command -v htpasswd &>/dev/null; then
+  HASH=$(htpasswd -bnBC 12 "" "$PEPPERED" | tr -d ':\n' | sed 's/^\$/\$/')
+else
+  echo "Error: install 'bcrypt' (pip install bcrypt) or 'htpasswd' (apache2-utils)" >&2
+  exit 1
+fi
+
+echo "${USERNAME}:${HASH}"