feat(api): sign-in, refresh rotation and bootstrap admin (M1)

- users, refresh_tokens and audit_log schema (migration 00002)
- argon2id passwords with rehash on login, password policy, lockout
  with exponential back-off and a per-IP rate limit in Redis
- Ed25519 JWT access tokens with kid-based key rotation; rotating
  refresh tokens with reuse detection (cookie for web, body for Android)
- bootstrap admin on first start; must_change_credentials and
  must_change_password gate every other endpoint
- /auth/login, /auth/refresh, /auth/logout(-all), /me, /me/password,
  /me/bootstrap-credentials, /me/sessions; server-info reports
  bootstrap_required
- role policy from docs/auth-and-roles.md with table tests
- problem+json errors with field errors; ru/en translations of the codes
- install.sh and update.sh generate JWT_PRIVATE_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/auth/common_passwords.txt

@@ -0,0 +1,152 @@
+# Частые пароли длиной от 8 символов (короче отсекает правило длины). Сравнение без учёта регистра.
+# Неполный список: расширяется добавлением строк, по одной на строку.
+12345678
+123456789
+1234567890
+12345678910
+123123123
+1234512345
+11111111
+111111111
+1111111111
+00000000
+0000000000
+22222222
+55555555
+66666666
+77777777
+88888888
+99999999
+87654321
+987654321
+0987654321
+11223344
+12341234
+12121212
+13131313
+147258369
+123456789a
+123456789q
+1q2w3e4r
+1q2w3e4r5t
+1q2w3e4r5t6y
+1qaz2wsx
+1qaz2wsx3edc
+zaq12wsx
+qwertyui
+qwertyuiop
+qwerty123
+qwerty1234
+qwerty12345
+qwerty123456
+qwertyqwerty
+asdfghjkl
+asdfasdf
+zxcvbnm123
+zxcvbnmm
+password
+password1
+password12
+password123
+password1234
+password!
+passw0rd
+p@ssw0rd
+p@ssword
+pa55word
+iloveyou
+iloveyou1
+iloveyou2
+sunshine
+princess
+football
+baseball
+basketball
+superman
+batman123
+starwars
+whatever
+trustno1
+letmein1
+welcome1
+welcome123
+changeme
+changeme123
+administrator
+admin123
+admin1234
+admin12345
+adminadmin
+administrator1
+rootroot
+root1234
+master123
+dragon123
+monkey123
+shadow123
+michael1
+jennifer
+computer
+internet
+abcd1234
+abc12345
+abc123456
+abcdefgh
+aaaaaaaa
+aa123456
+a1234567
+a12345678
+q1w2e3r4
+q1w2e3r4t5
+asdf1234
+1234qwer
+qwer1234
+q1234567
+myspace1
+charlie1
+freedom1
+mustang1
+liverpool
+chelsea1
+arsenal1
+fuckyou1
+secret123
+samsung1
+pokemon1
+minecraft
+loveyou1
+hello123
+helloworld
+yankees1
+jordan23
+access14
+cheese12
+michelle
+nicole12
+jessica1
+ashley12
+killer12
+soccer12
+hunter12
+ranger12
+buster12
+thomas12
+tigger12
+summer12
+spring12
+winter12
+autumn12
+qazwsxedc
+1234abcd
+pipu1234
+pipumusic
+music123
+music1234
+musiclover
+parol123
+parol1234
+privet123
+qwertyuiop123
+йцукенгш
+пароль123
+пароль1234