feat(api): sign-in, refresh rotation and bootstrap admin (M1)

- users, refresh_tokens and audit_log schema (migration 00002)
- argon2id passwords with rehash on login, password policy, lockout
  with exponential back-off and a per-IP rate limit in Redis
- Ed25519 JWT access tokens with kid-based key rotation; rotating
  refresh tokens with reuse detection (cookie for web, body for Android)
- bootstrap admin on first start; must_change_credentials and
  must_change_password gate every other endpoint
- /auth/login, /auth/refresh, /auth/logout(-all), /me, /me/password,
  /me/bootstrap-credentials, /me/sessions; server-info reports
  bootstrap_required
- role policy from docs/auth-and-roles.md with table tests
- problem+json errors with field errors; ru/en translations of the codes
- install.sh and update.sh generate JWT_PRIVATE_KEY

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/server/router.go

@@ -9,6 +9,7 @@ import (
 	"github.com/go-chi/chi/v5/middleware"
 
 	"pipu/api/internal/api/gen"
+	"pipu/api/internal/auth"
 	"pipu/api/internal/platform/httpx"
 	"pipu/api/internal/system"
 )
@@ -17,12 +18,22 @@ import (
 type Deps struct {
 	Log    *slog.Logger
 	System *system.Handler
+	Auth   *auth.Handler
+	// AuthService проверяет access-токены в middleware. nil — только для тестов служебных эндпоинтов.
+	AuthService *auth.Service
 }
 
 // handlers объединяет модули в единую реализацию gen.StrictServerInterface.
-// По мере появления модулей (auth, catalog, ...) они встраиваются сюда.
+// По мере появления модулей (catalog, ...) они встраиваются сюда.
+// Алиасы дают встроенным полям разные имена: у модулей одинаковое имя типа Handler.
+type (
+	systemHandler = system.Handler
+	authHandler   = auth.Handler
+)
+
 type handlers struct {
-	*system.Handler
+	*systemHandler
+	*authHandler
 }
 
 var _ gen.StrictServerInterface = handlers{}
@@ -36,10 +47,13 @@ func NewRouter(d Deps) http.Handler {
 
 	r := chi.NewRouter()
 	r.Use(middleware.RequestID, httpx.RealIP, httpx.AccessLog(log), middleware.Recoverer)
+	if d.AuthService != nil {
+		r.Use(auth.Middleware(d.AuthService, log))
+	}
 	r.NotFound(httpx.NotFound)
 	r.MethodNotAllowed(httpx.MethodNotAllowed)
 
-	strict := gen.NewStrictHandlerWithOptions(handlers{Handler: d.System}, nil, gen.StrictHTTPServerOptions{
+	strict := gen.NewStrictHandlerWithOptions(handlers{systemHandler: d.System, authHandler: d.Auth}, nil, gen.StrictHTTPServerOptions{
 		RequestErrorHandlerFunc:  httpx.RequestError,
 		ResponseErrorHandlerFunc: httpx.ResponseError(log),
 	})