add auth system and split backend into two-image CI/CD build

Backend:
- password hashing via hashlib.scrypt
- stateless HMAC-SHA256 tokens (7-day expiry)
- POST /api/auth/login, /api/auth/register (admin), /api/auth/reset-password
- admin user created from NAT20_ADMIN_USERNAME/PASSWORD on first startup
- users table, campaign_shares table, created_by on campaigns
- require_user dependency on all routes except auth
- campaign sharing: GET/POST/DELETE /api/campaigns/{id}/shares

Frontend:
- AuthContext: user/token state, login/logout, global fetch Auth header
- Login page, Users page (admin user management)
- route protection, sidebar user info/sign out

Docker/CI:
- split backend/Dockerfile into thin app-only image
- backend/Dockerfile.deps builds the heavy WhisperX/PyTorch base
- CI builds deps only when requirements.txt changes
- docker compose pull now fetches ~100KB app layer instead of 3.5GB

backend/Makefile

@@ -0,0 +1,36 @@
+# ────────────────────────────────────────────────────
+# Build helpers for the two-image CI/CD setup.
+#
+# Deps (WhisperX, PyTorch, etc.) live in a separate
+# base image that seldom changes.  CI builds deps
+# only when requirements.txt changes, then builds
+# the thin app image on every push — no pip install
+# during the common case, so pulls are tiny.
+#
+# Local dev — same flow:
+#   make deps    # one-time, 5-10 min
+#   make build   # fast, every time
+# ────────────────────────────────────────────────────
+
+DOCKER    := docker
+COMPOSE   := docker compose
+DEPS_IMG  := nat20-whisperx-base
+DEPS_FILE := Dockerfile.deps
+
+.PHONY: deps build run clean
+
+## deps       — Build the heavy deps layer (only when requirements.txt changes)
+deps:
+	$(DOCKER) build -f $(DEPS_FILE) -t $(DEPS_IMG) .
+
+## build      — Build the app image (fast — no pip)
+build:
+	$(DOCKER) build -t nat20-notes-backend .
+
+## run        — Start everything with docker compose
+run:
+	$(COMPOSE) up -d --build
+
+## clean      — Remove dangling images
+clean:
+	$(DOCKER) image prune -f