add auth system and split backend into two-image CI/CD build

Backend:
- password hashing via hashlib.scrypt
- stateless HMAC-SHA256 tokens (7-day expiry)
- POST /api/auth/login, /api/auth/register (admin), /api/auth/reset-password
- admin user created from NAT20_ADMIN_USERNAME/PASSWORD on first startup
- users table, campaign_shares table, created_by on campaigns
- require_user dependency on all routes except auth
- campaign sharing: GET/POST/DELETE /api/campaigns/{id}/shares

Frontend:
- AuthContext: user/token state, login/logout, global fetch Auth header
- Login page, Users page (admin user management)
- route protection, sidebar user info/sign out

Docker/CI:
- split backend/Dockerfile into thin app-only image
- backend/Dockerfile.deps builds the heavy WhisperX/PyTorch base
- CI builds deps only when requirements.txt changes
- docker compose pull now fetches ~100KB app layer instead of 3.5GB

backend/app/main.py

@@ -1,6 +1,6 @@
 from pathlib import Path
 
-from fastapi import FastAPI, Request
+from fastapi import Depends, FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import FileResponse, JSONResponse
 from fastapi import HTTPException
@@ -8,6 +8,9 @@ from fastapi import HTTPException
 from . import database as db, config
 from .logging_config import setup_logging, get_logger
 from .errors import PipelineError
+from .auth import ensure_admin_exists
+from .routers.auth import require_user
+from .routers import auth as auth_router
 from .routers import settings as settings_router
 from .routers import sessions as sessions_router
 from .routers import speakers as speakers_router
@@ -46,18 +49,20 @@ async def unhandled_error_handler(request: Request, exc: Exception):
 @app.on_event("startup")
 def on_startup():
     db.init_db()
+    ensure_admin_exists()
     log.info("Database initialized at %s", config.DB_PATH)
 
 
-app.include_router(settings_router.router)
-app.include_router(sessions_router.router)
-app.include_router(speakers_router.router)
-app.include_router(notes_router.router)
-app.include_router(jobs_router.router)
-app.include_router(models_router.router)
-app.include_router(diagnostics_router.router)
-app.include_router(files_router.router)
-app.include_router(campaigns_router.router)
+app.include_router(auth_router.router)
+app.include_router(settings_router.router, dependencies=[Depends(require_user)])
+app.include_router(sessions_router.router, dependencies=[Depends(require_user)])
+app.include_router(speakers_router.router, dependencies=[Depends(require_user)])
+app.include_router(notes_router.router, dependencies=[Depends(require_user)])
+app.include_router(jobs_router.router, dependencies=[Depends(require_user)])
+app.include_router(models_router.router, dependencies=[Depends(require_user)])
+app.include_router(diagnostics_router.router, dependencies=[Depends(require_user)])
+app.include_router(files_router.router, dependencies=[Depends(require_user)])
+app.include_router(campaigns_router.router, dependencies=[Depends(require_user)])
 
 
 MEDIA_TYPES = {
@@ -77,7 +82,7 @@ AUDIO_EXTS = frozenset(MEDIA_TYPES.keys())
 
 
 @app.get("/api/sessions/{session_id}/audio")
-def get_audio(session_id: str):
+def get_audio(session_id: str, user: dict = Depends(require_user)):
     row = db.get_conn().execute(
         "SELECT video_path, audio_path FROM sessions WHERE id = ?", (session_id,)
     ).fetchone()