add auth system and split backend into two-image CI/CD build

Backend:
- password hashing via hashlib.scrypt
- stateless HMAC-SHA256 tokens (7-day expiry)
- POST /api/auth/login, /api/auth/register (admin), /api/auth/reset-password
- admin user created from NAT20_ADMIN_USERNAME/PASSWORD on first startup
- users table, campaign_shares table, created_by on campaigns
- require_user dependency on all routes except auth
- campaign sharing: GET/POST/DELETE /api/campaigns/{id}/shares

Frontend:
- AuthContext: user/token state, login/logout, global fetch Auth header
- Login page, Users page (admin user management)
- route protection, sidebar user info/sign out

Docker/CI:
- split backend/Dockerfile into thin app-only image
- backend/Dockerfile.deps builds the heavy WhisperX/PyTorch base
- CI builds deps only when requirements.txt changes
- docker compose pull now fetches ~100KB app layer instead of 3.5GB

backend/app/routers/auth.py

@@ -0,0 +1,75 @@
+from fastapi import APIRouter, Depends, HTTPException, Header
+from typing import Optional
+
+from .. import database as db
+from ..auth import authenticate, get_user_from_token, hash_password, ensure_admin_exists
+
+router = APIRouter(prefix="/api/auth", tags=["auth"])
+
+
+def require_user(authorization: Optional[str] = Header(None)):
+    if not authorization or not authorization.startswith("Bearer "):
+        raise HTTPException(401, "Not authenticated")
+    user = get_user_from_token(authorization[7:])
+    if not user:
+        raise HTTPException(401, "Invalid or expired token")
+    return user
+
+
+def require_admin(user: dict = Depends(require_user)):
+    if not user["is_admin"]:
+        raise HTTPException(403, "Admin access required")
+    return user
+
+
+@router.post("/login")
+def login(body: dict):
+    username = body.get("username", "").strip()
+    password = body.get("password", "")
+    if not username or not password:
+        raise HTTPException(400, "Username and password are required")
+    result = authenticate(username, password)
+    if not result:
+        raise HTTPException(401, "Invalid username or password")
+    return result
+
+
+@router.post("/register")
+def register(body: dict, admin: dict = Depends(require_admin)):
+    username = body.get("username", "").strip()
+    password = body.get("password", "")
+    if not username or not password:
+        raise HTTPException(400, "Username and password are required")
+    if len(password) < 4:
+        raise HTTPException(400, "Password must be at least 4 characters")
+    existing = db.get_user_by_username(username)
+    if existing:
+        raise HTTPException(409, "Username already exists")
+    user = db.create_user(username, hash_password(password))
+    return {"id": user["id"], "username": user["username"]}
+
+
+@router.post("/reset-password")
+def reset_password(body: dict, admin: dict = Depends(require_admin)):
+    user_id = body.get("user_id", "").strip()
+    new_password = body.get("new_password", "")
+    if not user_id or not new_password:
+        raise HTTPException(400, "user_id and new_password are required")
+    if len(new_password) < 4:
+        raise HTTPException(400, "Password must be at least 4 characters")
+    user = db.get_user(user_id)
+    if not user:
+        raise HTTPException(404, "User not found")
+    db.update_user_password(user_id, hash_password(new_password))
+    return {"ok": True}
+
+
+@router.get("/me")
+def me(user: dict = Depends(require_user)):
+    user["is_admin"] = bool(user["is_admin"])
+    return user
+
+
+@router.get("/users")
+def list_users(admin: dict = Depends(require_admin)):
+    return db.list_users()