feat(api,web): auth et first-run — bootstrap admin, login, session, gardes

- api: auth controller/service, config env
- web: App/LoginPage/ProfilePage, garde d'auth, client API, styles
- shared: types/contrats auth
- compose: variables d'environnement first-run

Refs: #14

apps/web/src/auth/routing.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest";
+import { isPrivateRoute, isPublicRoute } from "./routing";
+
+describe("auth route guards", () => {
+  it("keeps login and setup public", () => {
+    expect(isPublicRoute({ name: "login" })).toBe(true);
+    expect(isPublicRoute({ name: "setup", step: "admin" })).toBe(true);
+  });
+
+  it("marks catalogue routes private", () => {
+    expect(isPrivateRoute({ name: "home" })).toBe(true);
+    expect(isPrivateRoute({ name: "search" })).toBe(true);
+    expect(isPrivateRoute({ name: "book", bookId: 1 })).toBe(true);
+  });
+});