feat(server): auth comptes utilisateurs et tokens API (ticket #48)

Ajoute la couche application (ports, use cases), les entités du
domaine, l'endpoint api/auth_api.dart (register/login/logout) et son
câblage dans le router, le hashing de mot de passe et le service de
token (infrastructure/security), et l'adapter Postgres des repositories
d'auth s'appuyant sur la table users du ticket #49. dart pub get OK,
dart analyze clean, dart test 10/10 vert (test PostgreSQL réel skip
faute de Docker disponible dans ce sandbox). Logique d'auth et
middleware testés via repositories fake en mémoire ; les endpoints
HTTP register/login/logout n'ont pas pu être exercés de bout en bout
faute d'accès à un vrai PostgreSQL local.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/test/auth_middleware_test.dart

@@ -0,0 +1,68 @@
+import 'package:gametime_server/api/auth_api.dart';
+import 'package:gametime_server/application/application.dart';
+import 'package:gametime_server/domain/domain.dart';
+import 'package:shelf/shelf.dart';
+import 'package:test/test.dart';
+
+void main() {
+  test('authentication middleware injects the authenticated request', () async {
+    final user = UserAccount(
+      id: 'user-1',
+      email: 'user@example.com',
+      passwordHash: 'hash',
+      createdAt: DateTime.utc(2026, 7, 19, 12),
+      updatedAt: DateTime.utc(2026, 7, 19, 12),
+    );
+    final session = AuthSession(
+      id: 'session-1',
+      userId: user.id,
+      tokenHash: 'token-hash',
+      issuedAt: DateTime.utc(2026, 7, 19, 12),
+      expiresAt: DateTime.utc(2026, 7, 20, 12),
+    );
+    final tokens = <String>[];
+    final handler =
+        authenticationMiddleware(({required token}) async {
+          tokens.add(token);
+          return AuthenticatedRequest(user: user, session: session);
+        })((request) {
+          final authenticated = authenticatedRequestFrom(request);
+          return Response.ok(authenticated?.user.id ?? 'missing');
+        });
+
+    final response = await handler(
+      Request(
+        'GET',
+        Uri.parse('http://localhost/protected'),
+        headers: {'authorization': 'Bearer clear-token'},
+      ),
+    );
+
+    expect(response.statusCode, 200);
+    expect(await response.readAsString(), 'user-1');
+    expect(tokens, ['clear-token']);
+  });
+
+  test(
+    'authentication middleware rejects missing or invalid bearer tokens',
+    () async {
+      final handler = authenticationMiddleware(({required token}) async {
+        throw const UnauthorizedException();
+      })((request) => Response.ok('secret'));
+
+      final missing = await handler(
+        Request('GET', Uri.parse('http://localhost/protected')),
+      );
+      final invalid = await handler(
+        Request(
+          'GET',
+          Uri.parse('http://localhost/protected'),
+          headers: {'authorization': 'Bearer invalid-token'},
+        ),
+      );
+
+      expect(missing.statusCode, 401);
+      expect(invalid.statusCode, 401);
+    },
+  );
+}