Initial commit: base slice (auth, roles, users, admin) scaffold

Backend: .NET 10 Clean Architecture + LiteCqrs.Net + EF Core/PostgreSQL +
Identity/JWT. Frontend: React 19 + Vite + TanStack Query/Router + Tailwind v4
with a retro CRT theme. Docker/compose deployment mirroring PnvPanel's
conventions, scoped down to the current base feature set.

backend/tests/TeleWave.Application.Tests/Auth/LoginCommandHandlerTests.cs

@@ -0,0 +1,76 @@
+using NSubstitute;
+using TeleWave.Application.Auth;
+using TeleWave.Application.Auth.Login;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+using Xunit;
+
+namespace TeleWave.Application.Tests.Auth;
+
+public class LoginCommandHandlerTests
+{
+    private readonly IIdentityService _identityService = Substitute.For<IIdentityService>();
+    private readonly IJwtTokenService _jwtTokenService = Substitute.For<IJwtTokenService>();
+    private readonly IRefreshTokenService _refreshTokenService =
+        Substitute.For<IRefreshTokenService>();
+
+    private LoginCommandHandler CreateHandler() =>
+        new(_identityService, _jwtTokenService, _refreshTokenService);
+
+    [Fact]
+    public async Task Handle_WithValidCredentials_ReturnsAuthResult()
+    {
+        var userId = Guid.NewGuid();
+        _identityService
+            .ValidateCredentialsAsync("alice", "password123", Arg.Any<CancellationToken>())
+            .Returns(Result.Success(new AuthenticatedUser(userId, "alice", "user")));
+        _identityService
+            .GetProfileAsync(userId, Arg.Any<CancellationToken>())
+            .Returns(new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", IsBlocked: false));
+        _jwtTokenService
+            .GenerateAccessToken(Arg.Any<AuthenticatedUser>())
+            .Returns(("access-token", DateTimeOffset.UtcNow.AddMinutes(15)));
+        _refreshTokenService
+            .IssueAsync(userId, Arg.Any<CancellationToken>())
+            .Returns(new IssuedRefreshToken("refresh-token", DateTimeOffset.UtcNow.AddDays(30)));
+
+        var result = await CreateHandler()
+            .Handle(new LoginCommand("alice", "password123"), CancellationToken.None);
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal("access-token", result.Value.AccessToken);
+        Assert.Equal("refresh-token", result.Value.RefreshToken);
+    }
+
+    [Fact]
+    public async Task Handle_WithInvalidCredentials_ReturnsFailure()
+    {
+        _identityService
+            .ValidateCredentialsAsync("alice", "wrong", Arg.Any<CancellationToken>())
+            .Returns(Result.Failure<AuthenticatedUser>(AuthErrors.InvalidCredentials));
+
+        var result = await CreateHandler()
+            .Handle(new LoginCommand("alice", "wrong"), CancellationToken.None);
+
+        Assert.False(result.IsSuccess);
+        Assert.Equal(AuthErrors.InvalidCredentials, result.Error);
+    }
+
+    [Fact]
+    public async Task Handle_WhenUserIsBlocked_ReturnsBlockedFailure()
+    {
+        var userId = Guid.NewGuid();
+        _identityService
+            .ValidateCredentialsAsync("alice", "password123", Arg.Any<CancellationToken>())
+            .Returns(Result.Success(new AuthenticatedUser(userId, "alice", "user")));
+        _identityService
+            .GetProfileAsync(userId, Arg.Any<CancellationToken>())
+            .Returns(new CurrentUserProfile(userId, "alice", Guid.NewGuid(), "user", IsBlocked: true));
+
+        var result = await CreateHandler()
+            .Handle(new LoginCommand("alice", "password123"), CancellationToken.None);
+
+        Assert.False(result.IsSuccess);
+        Assert.Equal(AuthErrors.Blocked, result.Error);
+    }
+}

backend/tests/TeleWave.Application.Tests/Auth/RegisterCommandHandlerTests.cs

@@ -0,0 +1,57 @@
+using NSubstitute;
+using TeleWave.Application.Auth;
+using TeleWave.Application.Auth.Register;
+using TeleWave.Application.Common.Interfaces;
+using TeleWave.Application.Common.Models;
+using Xunit;
+
+namespace TeleWave.Application.Tests.Auth;
+
+public class RegisterCommandHandlerTests
+{
+    private readonly IIdentityService _identityService = Substitute.For<IIdentityService>();
+    private readonly IJwtTokenService _jwtTokenService = Substitute.For<IJwtTokenService>();
+    private readonly IRefreshTokenService _refreshTokenService =
+        Substitute.For<IRefreshTokenService>();
+
+    private RegisterCommandHandler CreateHandler() =>
+        new(_identityService, _jwtTokenService, _refreshTokenService);
+
+    [Fact]
+    public async Task Handle_WithNewUserName_CreatesUserAndReturnsAuthResult()
+    {
+        var userId = Guid.NewGuid();
+        _identityService
+            .CreateUserAsync("bob", "password123", Arg.Any<CancellationToken>())
+            .Returns(Result.Success(userId));
+        _identityService
+            .GetProfileAsync(userId, Arg.Any<CancellationToken>())
+            .Returns(new CurrentUserProfile(userId, "bob", Guid.NewGuid(), "user", IsBlocked: false));
+        _jwtTokenService
+            .GenerateAccessToken(Arg.Any<AuthenticatedUser>())
+            .Returns(("access-token", DateTimeOffset.UtcNow.AddMinutes(15)));
+        _refreshTokenService
+            .IssueAsync(userId, Arg.Any<CancellationToken>())
+            .Returns(new IssuedRefreshToken("refresh-token", DateTimeOffset.UtcNow.AddDays(30)));
+
+        var result = await CreateHandler()
+            .Handle(new RegisterCommand("bob", "password123"), CancellationToken.None);
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal("bob", result.Value.User.UserName);
+    }
+
+    [Fact]
+    public async Task Handle_WithTakenUserName_ReturnsFailure()
+    {
+        _identityService
+            .CreateUserAsync("bob", "password123", Arg.Any<CancellationToken>())
+            .Returns(Result.Failure<Guid>(AuthErrors.UserNameTaken));
+
+        var result = await CreateHandler()
+            .Handle(new RegisterCommand("bob", "password123"), CancellationToken.None);
+
+        Assert.False(result.IsSuccess);
+        Assert.Equal(AuthErrors.UserNameTaken, result.Error);
+    }
+}