add auth system and split backend into two-image CI/CD build

Backend:
- password hashing via hashlib.scrypt
- stateless HMAC-SHA256 tokens (7-day expiry)
- POST /api/auth/login, /api/auth/register (admin), /api/auth/reset-password
- admin user created from NAT20_ADMIN_USERNAME/PASSWORD on first startup
- users table, campaign_shares table, created_by on campaigns
- require_user dependency on all routes except auth
- campaign sharing: GET/POST/DELETE /api/campaigns/{id}/shares

Frontend:
- AuthContext: user/token state, login/logout, global fetch Auth header
- Login page, Users page (admin user management)
- route protection, sidebar user info/sign out

Docker/CI:
- split backend/Dockerfile into thin app-only image
- backend/Dockerfile.deps builds the heavy WhisperX/PyTorch base
- CI builds deps only when requirements.txt changes
- docker compose pull now fetches ~100KB app layer instead of 3.5GB

docker-compose.example.yml

@@ -6,24 +6,22 @@ services:
   backend:
     # ── Pre-built image (pull from registry) ──────────────────
     image: gitea.kansaigaijin.com/Jamie/Nat20-Notes/backend:latest
-    # ── Or build locally (uncomment below) ────────────────────
-    # build:
-    #   context: ./backend
-    #   target: runtime
+    # ── Or build locally after make deps (uncomment below) ────
+    # build: ./backend
 
     restart: unless-stopped
     environment:
+      # ── Auth ────────────────────────────────────────────────
+      NAT20_ADMIN_USERNAME: "admin"
+      NAT20_ADMIN_PASSWORD: "admin"
+
       # ── Setup wizard ──────────────────────────────────────
       # "false" (or omit) to show the wizard on first run.
       # Set to "true" after onboarding completes.
       NAT20_ONBOARDING_COMPLETED: "false"
 
       # ── Transcription ─────────────────────────────────────
-      # Model size:  tiny | base | small | medium | large-v3
       NAT20_WHISPER_MODEL: medium
-      # Compute precision:  int8 (fastest/least VRAM)
-      #                    | float16 (more accurate)
-      #                    | float32 (full precision, slowest)
       NAT20_WHISPER_COMPUTE_TYPE: int8
 
       # Required for speaker diarization (accept HF gated-model terms first)
@@ -40,30 +38,14 @@ services:
       # NAT20_API_MODEL: gpt-4o-mini
 
       # ── Summarization ─────────────────────────────────────
-      # Target words per chunk. Long transcripts are split into
-      # chunks, each summarized separately.  Lower = more LLM
-      # calls but finer granularity.   Higher = more context per
-      # chunk but may exceed the model's context window.
-      # Default 2500 works for most models (8K–128K context).
       # NAT20_CHUNK_WORD_TARGET: "2500"
-
-      # Campaign context injected into every summarization prompt.
-      # Inline string or path to a file inside the container.
       # NAT20_WORLD_CONTEXT: ""
       # NAT20_WORLD_CONTEXT_PATH: /data/campaign-context.txt
-
-      # Player recap format:  story | diary | bullets | custom
       # NAT20_PLAYER_RECAP_STYLE: story
       # NAT20_PLAYER_RECAP_CUSTOM_PROMPT: ""
 
     volumes:
-      # ── Data persistence ──────────────────────────────────
-      # Option A: Named volume (auto-managed, no host path needed)
       - app_data:/data
-      # Option B: Host bind mount (replace with your path)
-      # - /mnt/media/dnd-sessions:/data
-
-      # HuggingFace + Torch model caches (avoid re-downloading)
       - hf_cache:/root/.cache/huggingface
       - torch_cache:/root/.cache/torch