feat(server): auth comptes utilisateurs et tokens API (ticket #48)

Ajoute la couche application (ports, use cases), les entités du
domaine, l'endpoint api/auth_api.dart (register/login/logout) et son
câblage dans le router, le hashing de mot de passe et le service de
token (infrastructure/security), et l'adapter Postgres des repositories
d'auth s'appuyant sur la table users du ticket #49. dart pub get OK,
dart analyze clean, dart test 10/10 vert (test PostgreSQL réel skip
faute de Docker disponible dans ce sandbox). Logique d'auth et
middleware testés via repositories fake en mémoire ; les endpoints
HTTP register/login/logout n'ont pas pu être exercés de bout en bout
faute d'accès à un vrai PostgreSQL local.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/README.md

@@ -69,11 +69,27 @@ Expected response:
 {"status":"ok"}
 ```
 
+## Authentication
+
+Ticket #48 adds account registration, login, logout and bearer-token request
+authentication.
+
+Endpoints:
+
+- `POST /auth/register` with `{ "email": "...", "password": "...", "displayName": "..." }`.
+- `POST /auth/login` with `{ "email": "...", "password": "...", "deviceLabel": "..." }`.
+- `POST /auth/logout` with `Authorization: Bearer <token>`.
+
+Passwords are stored with PBKDF2-HMAC-SHA256 via `package:cryptography`, using a
+per-password random salt. API tokens are opaque random values; only a SHA-256
+hash of the token is stored in PostgreSQL.
+
 ## Scope
 
 Ticket #47 only scaffolds the Dart server, the hexagonal directory layout and
-the `/health` endpoint. Ticket #49 adds the first PostgreSQL schema only; auth,
-sync endpoints and sharing behavior are still implemented in later tickets.
+the `/health` endpoint. Ticket #49 adds the first PostgreSQL schema. Ticket #48
+adds authentication only; sync endpoints and sharing behavior are still
+implemented in later tickets.
 
 Upcoming tickets will fill the empty adapters and use cases: