add auth system and split backend into two-image CI/CD build

Backend:
- password hashing via hashlib.scrypt
- stateless HMAC-SHA256 tokens (7-day expiry)
- POST /api/auth/login, /api/auth/register (admin), /api/auth/reset-password
- admin user created from NAT20_ADMIN_USERNAME/PASSWORD on first startup
- users table, campaign_shares table, created_by on campaigns
- require_user dependency on all routes except auth
- campaign sharing: GET/POST/DELETE /api/campaigns/{id}/shares

Frontend:
- AuthContext: user/token state, login/logout, global fetch Auth header
- Login page, Users page (admin user management)
- route protection, sidebar user info/sign out

Docker/CI:
- split backend/Dockerfile into thin app-only image
- backend/Dockerfile.deps builds the heavy WhisperX/PyTorch base
- CI builds deps only when requirements.txt changes
- docker compose pull now fetches ~100KB app layer instead of 3.5GB

AGENTS.md

@@ -2,7 +2,9 @@
 
 ## Commands
 
-- `docker compose up -d --build` — build & launch both services (backend :8000, frontend :8020)
+- `make deps` — one-time build of the heavy WhisperX/PyTorch layer (5-10 min)
+- `make build` — fast app-only rebuild (seconds)
+- `docker compose pull && docker compose up -d` — pull & run pre-built images from registry
 - `cd frontend && npm run dev` — Vite dev server (proxies `/api` → `localhost:8000`)
 - **No tests, no lint/typecheck scripts exist.** Don't look for them.
 
@@ -23,10 +25,34 @@ When adding a setting key, add it to `config.py:CAMPAIGN_SETTINGS`, the frontend
 ## Docker / framework quirks
 
 - Torch pinned to `2.3.1` with `cu121` wheels (`--extra-index-url https://download.pytorch.org/whl/cu121`) — cuDNN ABI compat with `ctranslate2`. Don't bump unpinned.
-- Backend Dockerfile is two-stage (builder + runtime). ffmpeg required in runtime for audio extraction.
+- Backend has two Dockerfiles:
+  - `Dockerfile` — thin, app-only. Starts `FROM nat20-whisperx-base:latest`. Used by CI for fast rebuilds and by `make build`.
+  - `Dockerfile.deps` — full WhisperX base layer. Build once per `requirements.txt` change. Used by CI and `make deps`.
+  - `Makefile` — `make deps` builds the heavy layer; `make build` does fast app-only rebuild.
+- **CI/CD pattern**: Gitea runner builds & pushes `nat20-whisperx-base:latest` only when `requirements.txt` changes, then builds & pushes `backend:latest` (thin) on every push. Your `docker compose pull` only downloads new app layers (~100 KB) — the 3 GB WhisperX layer stays cached.
+- ffmpeg required in runtime for audio extraction.
 - nginx `client_max_body_size` 500M, proxy timeouts 3600s. Files >15MB auto-chunked by frontend `createSession()`.
 - Frontend changes in Compose mode require a rebuild (`docker compose up -d --build`). Vite dev server is for local-only dev.
 
+### Optimised rebuild workflow
+
+```bash
+# One-time: build the heavy WhisperX/PyTorch layer
+make deps
+
+# Daily: rebuild only app code (seconds, not minutes)
+make build
+
+# Or with docker compose if you've done make deps first:
+docker compose up -d --build
+```
+
+## Auth
+
+- First user is admin, created from `NAT20_ADMIN_USERNAME` / `NAT20_ADMIN_PASSWORD` env vars on first startup.
+- Admin can create users via the Users page. Users can share campaigns with other registered users.
+- JWT tokens (HMAC‑SHA256, 7-day expiry) stored in localStorage. Global fetch interceptor adds `Authorization: Bearer` to all `/api/` calls.
+
 ## Tailwind theme
 
 Custom colors (`deep`, `panel`, `brass`, `ember`, etc.) and fonts (`Fraunces`, `Inter`, `IBM Plex Mono`) in `tailwind.config.js`. Reusable component classes in `frontend/src/styles.css` (`.card`, `.btn-primary`, `.btn-secondary`, `.input`, `.eyebrow`) — use these over raw Tailwind utilities.