feat(api): sign-in, refresh rotation and bootstrap admin (M1)

- users, refresh_tokens and audit_log schema (migration 00002)
- argon2id passwords with rehash on login, password policy, lockout
  with exponential back-off and a per-IP rate limit in Redis
- Ed25519 JWT access tokens with kid-based key rotation; rotating
  refresh tokens with reuse detection (cookie for web, body for Android)
- bootstrap admin on first start; must_change_credentials and
  must_change_password gate every other endpoint
- /auth/login, /auth/refresh, /auth/logout(-all), /me, /me/password,
  /me/bootstrap-credentials, /me/sessions; server-info reports
  bootstrap_required
- role policy from docs/auth-and-roles.md with table tests
- problem+json errors with field errors; ru/en translations of the codes
- install.sh and update.sh generate JWT_PRIVATE_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/data-model.md

@@ -38,6 +38,7 @@ CREATE TABLE refresh_tokens (
   id           uuid PRIMARY KEY,
   user_id      uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
   family_id    uuid NOT NULL,                -- цепочка ротаций одного входа
+  family_started_at timestamptz NOT NULL,    -- время входа: абсолютный срок семьи (180 дней)
   token_hash   bytea NOT NULL UNIQUE,        -- SHA-256 от токена
   device_name  text,                         -- "Chrome / Windows", "Pixel 8"
   client_type  text NOT NULL,                -- 'web' | 'android'