feat(web): sign-in, first-run setup, app shell and user admin (M1)

- core: AuthSession keeps the access token in memory, refreshes it
  once for all parallel requests (single-flight) and retries them;
  refresh races between tabs are retried, reuse signs out; ApiError
  carries problem+json codes and field errors
- web: TanStack Router with guards — guests go to /login, the bootstrap
  admin to /setup/admin, temporary passwords to /setup/password, admin
  pages by role
- login, setup screens, Classic shell (top bar, role-based sidebar,
  empty player), settings: name, theme, language, password, devices
- users admin: search, role filter, create with a one-time temporary
  password, reset, block, role change, delete as the policy allows;
  audit log for admins
- ru/en strings for auth, admin and error codes; language and theme
  are saved in the profile

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/i18n/locales/en/auth.json

@@ -0,0 +1,24 @@
+{
+  "login": {
+    "title": "Sign in",
+    "subtitle": "Your music from your own server",
+    "username": "Username",
+    "password": "Password",
+    "submit": "Sign in",
+    "bootstrap_hint": "First start: sign in as the administrator. The password is set in BOOTSTRAP_ADMIN_PASSWORD or printed in the api service log."
+  },
+  "setup": {
+    "admin_badge": "First administrator sign-in",
+    "admin_title": "Change the username and password",
+    "admin_text": "The server stays locked until you do: the initial administrator credentials are visible in logs and settings.",
+    "password_badge": "Password reset",
+    "password_title": "Set a new password",
+    "password_text": "You signed in with a temporary password. Choose your own — the temporary one will stop working.",
+    "new_username": "New username",
+    "new_password": "New password",
+    "repeat_password": "Repeat the password",
+    "min_length": "At least {{min}} characters",
+    "submit": "Save and continue",
+    "logout": "Sign out"
+  }
+}