feat(api): sign-in, refresh rotation and bootstrap admin (M1)

- users, refresh_tokens and audit_log schema (migration 00002)
- argon2id passwords with rehash on login, password policy, lockout
  with exponential back-off and a per-IP rate limit in Redis
- Ed25519 JWT access tokens with kid-based key rotation; rotating
  refresh tokens with reuse detection (cookie for web, body for Android)
- bootstrap admin on first start; must_change_credentials and
  must_change_password gate every other endpoint
- /auth/login, /auth/refresh, /auth/logout(-all), /me, /me/password,
  /me/bootstrap-credentials, /me/sessions; server-info reports
  bootstrap_required
- role policy from docs/auth-and-roles.md with table tests
- problem+json errors with field errors; ru/en translations of the codes
- install.sh and update.sh generate JWT_PRIVATE_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/i18n/src/index.ts

@@ -1,7 +1,9 @@
 import i18next, { type i18n as I18n } from 'i18next';
 
 import enCommon from '../locales/en/common.json';
+import enErrors from '../locales/en/errors.json';
 import ruCommon from '../locales/ru/common.json';
+import ruErrors from '../locales/ru/errors.json';
 
 /** Поддерживаемые языки. Новый язык = папка в locales/ + строка здесь. */
 export const SUPPORTED_LOCALES = ['ru', 'en'] as const;
@@ -9,8 +11,8 @@ export type Locale = (typeof SUPPORTED_LOCALES)[number];
 export const DEFAULT_LOCALE: Locale = 'en';
 
 export const resources = {
-  ru: { common: ruCommon },
-  en: { common: enCommon },
+  ru: { common: ruCommon, errors: ruErrors },
+  en: { common: enCommon, errors: enErrors },
 } as const;
 
 declare module 'i18next' {
@@ -38,7 +40,7 @@ export async function createI18n(locale: Locale): Promise<I18n> {
     fallbackLng: DEFAULT_LOCALE,
     supportedLngs: [...SUPPORTED_LOCALES],
     defaultNS: 'common',
-    ns: ['common'],
+    ns: ['common', 'errors'],
     resources,
     interpolation: { escapeValue: false },
     returnNull: false,