feat: add JWT authentication with register, login, refresh, and me endpoints

Adds bcrypt password hashing, JWT access/refresh token generation, requireAuth middleware, and /api/auth routes (POST /register, POST /login, POST /refresh, GET /me).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/server/src/index.ts

@@ -1,5 +1,6 @@
 import express from 'express';
 import cors from 'cors';
+import authRouter from './routes/auth.js';
 
 const app = express();
 app.use(cors());
@@ -9,6 +10,8 @@ app.get('/api/health', (_req, res) => {
   res.json({ success: true, data: { status: 'ok' } });
 });
 
+app.use('/api/auth', authRouter);
+
 const port = process.env.SERVER_PORT || 3000;
 app.listen(port, () => {
   console.log(`Server running on port ${port}`);