feat(server): auth comptes utilisateurs et tokens API (ticket #48)

Ajoute la couche application (ports, use cases), les entités du
domaine, l'endpoint api/auth_api.dart (register/login/logout) et son
câblage dans le router, le hashing de mot de passe et le service de
token (infrastructure/security), et l'adapter Postgres des repositories
d'auth s'appuyant sur la table users du ticket #49. dart pub get OK,
dart analyze clean, dart test 10/10 vert (test PostgreSQL réel skip
faute de Docker disponible dans ce sandbox). Logique d'auth et
middleware testés via repositories fake en mémoire ; les endpoints
HTTP register/login/logout n'ont pas pu être exercés de bout en bout
faute d'accès à un vrai PostgreSQL local.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/lib/infrastructure/security/README.md

@@ -1,5 +1,7 @@
 # Security infrastructure
 
-Placeholder for password hashing, token signing and token verification.
+Password hashing uses PBKDF2-HMAC-SHA256 via `package:cryptography`, with a
+random per-password salt and encoded parameters in the stored hash.
 
-Authentication is planned for ticket #48.
+API tokens are opaque random base64url strings generated with `Random.secure()`.
+Only the SHA-256 hash of a token is persisted.

server/lib/infrastructure/security/password_hasher.dart

@@ -0,0 +1,88 @@
+import 'dart:convert';
+import 'dart:math';
+
+import 'package:cryptography/cryptography.dart';
+
+import '../../application/application.dart';
+import '../../domain/domain.dart';
+
+final class Pbkdf2PasswordHasher implements PasswordHasher {
+  Pbkdf2PasswordHasher({
+    this.iterations = 210000,
+    this.saltLength = 16,
+    this.bits = 256,
+    Random? random,
+  }) : _random = random ?? Random.secure();
+
+  final int iterations;
+  final int saltLength;
+  final int bits;
+  final Random _random;
+
+  @override
+  Future<String> hash(String password) async {
+    final salt = List<int>.generate(saltLength, (_) => _random.nextInt(256));
+    final hash = await _derive(password, salt, iterations, bits);
+    return [
+      'pbkdf2_sha256',
+      iterations.toString(),
+      base64UrlEncode(salt),
+      base64UrlEncode(hash),
+    ].join(r'$');
+  }
+
+  @override
+  Future<bool> verify({
+    required String password,
+    required String passwordHash,
+  }) async {
+    final parts = passwordHash.split(r'$');
+    if (parts.length != 4 || parts[0] != 'pbkdf2_sha256') {
+      throw const ValidationException('Unsupported password hash format.');
+    }
+
+    final parsedIterations = int.tryParse(parts[1]);
+    if (parsedIterations == null || parsedIterations <= 0) {
+      throw const ValidationException('Invalid password hash iterations.');
+    }
+
+    final salt = base64Url.decode(parts[2]);
+    final expectedHash = base64Url.decode(parts[3]);
+    final actualHash = await _derive(
+      password,
+      salt,
+      parsedIterations,
+      expectedHash.length * 8,
+    );
+    return _constantTimeEquals(actualHash, expectedHash);
+  }
+
+  Future<List<int>> _derive(
+    String password,
+    List<int> salt,
+    int iterations,
+    int bits,
+  ) async {
+    final algorithm = Pbkdf2(
+      macAlgorithm: Hmac.sha256(),
+      iterations: iterations,
+      bits: bits,
+    );
+    final key = await algorithm.deriveKey(
+      secretKey: SecretKey(utf8.encode(password)),
+      nonce: salt,
+    );
+    return key.extractBytes();
+  }
+}
+
+bool _constantTimeEquals(List<int> left, List<int> right) {
+  if (left.length != right.length) {
+    return false;
+  }
+  var diff = 0;
+  for (var index = 0; index < left.length; index++) {
+    diff |= left[index] ^ right[index];
+  }
+  return diff == 0;
+}

server/lib/infrastructure/security/runtime_services.dart

@@ -0,0 +1,32 @@
+import 'dart:math';
+
+import '../../application/application.dart';
+
+final class SystemClock implements Clock {
+  const SystemClock();
+
+  @override
+  DateTime now() => DateTime.now().toUtc();
+}
+
+final class UuidV4Generator implements IdGenerator {
+  UuidV4Generator({Random? random}) : _random = random ?? Random.secure();
+
+  final Random _random;
+
+  @override
+  String newId() {
+    final bytes = List<int>.generate(16, (_) => _random.nextInt(256));
+    bytes[6] = (bytes[6] & 0x0f) | 0x40;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    final hex = bytes.map((byte) => byte.toRadixString(16).padLeft(2, '0'));
+    final value = hex.join();
+    return [
+      value.substring(0, 8),
+      value.substring(8, 12),
+      value.substring(12, 16),
+      value.substring(16, 20),
+      value.substring(20),
+    ].join('-');
+  }
+}

server/lib/infrastructure/security/security.dart

@@ -0,0 +1,3 @@
+export 'password_hasher.dart';
+export 'runtime_services.dart';
+export 'token_service.dart';

server/lib/infrastructure/security/token_service.dart

@@ -0,0 +1,25 @@
+import 'dart:convert';
+import 'dart:math';
+
+import 'package:crypto/crypto.dart';
+
+import '../../application/application.dart';
+
+final class SecureOpaqueTokenService implements OpaqueTokenService {
+  SecureOpaqueTokenService({this.byteLength = 32, Random? random})
+    : _random = random ?? Random.secure();
+
+  final int byteLength;
+  final Random _random;
+
+  @override
+  String generateToken() {
+    final bytes = List<int>.generate(byteLength, (_) => _random.nextInt(256));
+    return base64UrlEncode(bytes).replaceAll('=', '');
+  }
+
+  @override
+  String hashToken(String token) {
+    return sha256.convert(utf8.encode(token)).toString();
+  }
+}