add auth system and split backend into two-image CI/CD build

Backend:
- password hashing via hashlib.scrypt
- stateless HMAC-SHA256 tokens (7-day expiry)
- POST /api/auth/login, /api/auth/register (admin), /api/auth/reset-password
- admin user created from NAT20_ADMIN_USERNAME/PASSWORD on first startup
- users table, campaign_shares table, created_by on campaigns
- require_user dependency on all routes except auth
- campaign sharing: GET/POST/DELETE /api/campaigns/{id}/shares

Frontend:
- AuthContext: user/token state, login/logout, global fetch Auth header
- Login page, Users page (admin user management)
- route protection, sidebar user info/sign out

Docker/CI:
- split backend/Dockerfile into thin app-only image
- backend/Dockerfile.deps builds the heavy WhisperX/PyTorch base
- CI builds deps only when requirements.txt changes
- docker compose pull now fetches ~100KB app layer instead of 3.5GB

backend/app/database.py

@@ -87,14 +87,36 @@ def init_db():
                 updated_at REAL NOT NULL
             )
         """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS users (
+                id TEXT PRIMARY KEY,
+                username TEXT UNIQUE NOT NULL,
+                password_hash TEXT NOT NULL,
+                is_admin INTEGER NOT NULL DEFAULT 0,
+                created_at REAL NOT NULL
+            )
+        """)
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS campaign_shares (
+                campaign_id TEXT NOT NULL REFERENCES campaigns(id) ON DELETE CASCADE,
+                user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                role TEXT NOT NULL DEFAULT 'editor',
+                PRIMARY KEY (campaign_id, user_id)
+            )
+        """)
         conn.execute("""
             CREATE TABLE IF NOT EXISTS campaigns (
                 id TEXT PRIMARY KEY,
                 name TEXT NOT NULL,
                 description TEXT NOT NULL DEFAULT '',
-                created_at REAL NOT NULL
+                created_at REAL NOT NULL,
+                created_by TEXT REFERENCES users(id) ON DELETE SET NULL
             )
         """)
+        try:
+            conn.execute("ALTER TABLE campaigns ADD COLUMN created_by TEXT REFERENCES users(id) ON DELETE SET NULL")
+        except Exception:
+            pass
         conn.execute("""
             CREATE TABLE IF NOT EXISTS campaign_settings (
                 campaign_id TEXT NOT NULL REFERENCES campaigns(id) ON DELETE CASCADE,
@@ -110,7 +132,7 @@ def init_db():
         default = conn.execute("SELECT id FROM campaigns WHERE id = 'default'").fetchone()
         if not default:
             conn.execute(
-                "INSERT INTO campaigns (id, name, description, created_at) VALUES (?, ?, '', ?)",
+                "INSERT INTO campaigns (id, name, description, created_at, created_by) VALUES (?, ?, '', ?, NULL)",
                 ("default", "Default Campaign", now()),
             )
             conn.execute("UPDATE sessions SET campaign_id = 'default' WHERE campaign_id IS NULL")
@@ -207,12 +229,12 @@ def get_job(job_id: str) -> dict | None:
     row = get_conn().execute("SELECT * FROM jobs WHERE id = ?", (job_id,)).fetchone()
     return dict(row) if row else None
 
-def create_campaign(name: str, description: str = "") -> dict:
+def create_campaign(name: str, description: str = "", created_by: str | None = None) -> dict:
     campaign_id = new_id()
     with tx() as conn:
         conn.execute(
-            "INSERT INTO campaigns (id, name, description, created_at) VALUES (?, ?, ?, ?)",
-            (campaign_id, name, description, now()),
+            "INSERT INTO campaigns (id, name, description, created_at, created_by) VALUES (?, ?, ?, ?, ?)",
+            (campaign_id, name, description, now(), created_by),
         )
         # Inherit CAMPAIGN_SETTINGS from the "default" campaign as a starting point
         parent = conn.execute(
@@ -255,6 +277,89 @@ def update_campaign(campaign_id: str, name: str | None = None, description: str
         conn.execute(f"UPDATE campaigns SET {cols} WHERE id = ?", (*fields.values(), campaign_id))
     return get_campaign(campaign_id)
 
+# ── Users ──────────────────────────────────────────────────────────────────
+
+def get_user(user_id: str) -> dict | None:
+    row = get_conn().execute("SELECT * FROM users WHERE id = ?", (user_id,)).fetchone()
+    return dict(row) if row else None
+
+
+def get_user_by_username(username: str) -> dict | None:
+    row = get_conn().execute("SELECT * FROM users WHERE username = ?", (username,)).fetchone()
+    return dict(row) if row else None
+
+
+def create_user(username: str, password_hash: str, is_admin: bool = False) -> dict:
+    uid = new_id()
+    with tx() as conn:
+        conn.execute(
+            "INSERT INTO users (id, username, password_hash, is_admin, created_at) VALUES (?, ?, ?, ?, ?)",
+            (uid, username, password_hash, 1 if is_admin else 0, now()),
+        )
+    return get_user(uid)
+
+
+def update_user_password(user_id: str, password_hash: str):
+    with tx() as conn:
+        conn.execute("UPDATE users SET password_hash = ? WHERE id = ?", (password_hash, user_id))
+
+
+def list_users() -> list[dict]:
+    rows = get_conn().execute(
+        "SELECT id, username, is_admin, created_at FROM users ORDER BY created_at"
+    ).fetchall()
+    return [dict(r) for r in rows]
+
+
+# ── Campaign sharing ──────────────────────────────────────────────────────
+
+def share_campaign(campaign_id: str, user_id: str, role: str = "editor"):
+    with tx() as conn:
+        conn.execute(
+            "INSERT OR REPLACE INTO campaign_shares (campaign_id, user_id, role) VALUES (?, ?, ?)",
+            (campaign_id, user_id, role),
+        )
+
+
+def unshare_campaign(campaign_id: str, user_id: str):
+    with tx() as conn:
+        conn.execute(
+            "DELETE FROM campaign_shares WHERE campaign_id = ? AND user_id = ?",
+            (campaign_id, user_id),
+        )
+
+
+def get_campaign_shares(campaign_id: str) -> list[dict]:
+    rows = get_conn().execute("""
+        SELECT u.id, u.username, cs.role
+        FROM campaign_shares cs
+        JOIN users u ON u.id = cs.user_id
+        WHERE cs.campaign_id = ?
+    """, (campaign_id,)).fetchall()
+    return [dict(r) for r in rows]
+
+
+def get_user_campaigns(user_id: str) -> list[dict]:
+    rows = get_conn().execute("""
+        SELECT c.*, cs.role as access_role,
+            (SELECT COUNT(*) FROM sessions s WHERE s.campaign_id = c.id) as session_count
+        FROM campaigns c
+        LEFT JOIN campaign_shares cs ON cs.campaign_id = c.id
+        WHERE c.created_by = ? OR cs.user_id = ?
+        ORDER BY c.created_at DESC
+    """, (user_id, user_id)).fetchall()
+    return [dict(r) for r in rows]
+
+
+def can_access_campaign(user_id: str, campaign_id: str) -> bool:
+    row = get_conn().execute("""
+        SELECT 1 FROM campaigns WHERE id = ? AND created_by = ?
+        UNION
+        SELECT 1 FROM campaign_shares WHERE campaign_id = ? AND user_id = ?
+    """, (campaign_id, user_id, campaign_id, user_id)).fetchone()
+    return row is not None
+
+
 def delete_campaign(campaign_id: str) -> bool:
     with tx() as conn:
         conn.execute("UPDATE sessions SET campaign_id = NULL WHERE campaign_id = ?", (campaign_id,))