feat(auth): JWT authentication, user management, and hybrid CSRF

[lekhrocks]

Summary

Implements real authentication for the control plane: JWT login against a users table (BCrypt hashes), full user management, JWT validation via Spring Security oauth2 resource-server, and a hybrid CSRF policy. This resolves the previously-hollow security config (CSRF disabled, no auth mechanism) and the "Disabled Spring CSRF protection" scan finding.

Changes

Auth core

• Dependencies: spring-security-oauth2-jose + spring-security-oauth2-resource-server
• JWT: JwtProperties (syncflow.jwt.*) + JwtSecurityConfig — HS256 encoder/decoder via Nimbus; secret validated (base64, ≥ 32 bytes) with clear startup errors
• Beans: BCrypt PasswordEncoder, AuthenticationManager (non-deprecated DaoAuthenticationProvider constructor), JwtAuthenticationConverter
• Security chain: oauth2ResourceServer JWT bearer for /api/**, hybrid CSRF (cookie repo, /api/** bearer paths ignored), stateless, /api/auth/** public

Users

• V9 migration: app_users table + seeded admin (BCrypt). Named app_users (not users) to avoid colliding with sample/integration tables.
• Domain: UserEntity, UserRepository, UserService (create/update/roles/delete, role allow-list, password encoding), RoleConstants, DbUserDetailsService (CSV roles → ROLE_* authorities)
• Endpoints: POST /api/auth/login, GET /api/auth/me, /api/users CRUD + role assignment (guarded by existing RBAC, @Valid Bean Validation)
• AuthService: issues JWT with scope claim carrying roles; carries authorities from the authenticated principal (no duplicate user-store query)

RBAC fixes

• AdminController.createOrg: AI_USE → ORG_WRITE (copy-paste bug)
• Added guards on revokeApiKey (APIKEY_REVOKE) and getQuota (ORG_READ)

Tests

• ApiAuthContractTest: login success / bad-password 401 / token-authed 200 / unauthenticated 401
• AuthServiceTest, DbUserDetailsServiceTest, UserServiceTest, UserEntityMappingTest (guards the app_users table name)

Docs

• docs/api/auth.md — login/me endpoints, token usage, syncflow.jwt.* config
• docs/security/authentication.md — auth model, CSRF policy, threat mapping
• API stability matrix updated

Design notes

• Stateless bearer auth (no session); HS256 symmetric (RS256 documented upgrade path).
• Auth plugs into the existing RBAC (TenantFilter → AuthorizationService/PolicyResolver) — no parallel authz model.
• Login returns uniform 401 for bad/disabled/locked accounts (no account enumeration).

Validation

• Full ./gradlew test green; all security + user + PgMongo suites pass.