Add a single-credential login gate for self-hosted deployments

[brylie]

Compendium's web UI currently has no access control — anyone who can reach the server's address can open it. Fine for a purely local (127.0.0.1) deployment, but a real exposure once the instance is reachable beyond localhost (home server, VPS, tailnet, etc.). This is access control for a still-single-tenant deployment, not multi-user authentication — there's still exactly one person using the workspace; see Non-Goal #7 in docs/prd.md, which this issue does not cross.

• Add session-based login using better-auth (MIT-licensed, official Drizzle adapter with SQLite support — fits the existing persistence.md SQLite/Drizzle setup, no new backend process)
• Configure with a single admin credential — skip better-auth's organization/teams plugin entirely; that's Phase 1 territory, not this issue
• Gate the SvelteKit UI routes, the /ws Yjs endpoint, and the /mcp endpoint behind the session — an unauthenticated deployment shouldn't leave any of the three surfaces open
• Document login setup (env vars / first-run credential creation) in the README or a deployment doc

Done when: a self-hosted instance reachable beyond localhost requires login before any UI, WebSocket, or MCP access succeeds, and setup is documented.

Not in scope: multi-user accounts, per-user permissions, OAuth-style external client connections — Phase 1 (Non-Goal #7 / Timeline Considerations).

[brylie]

Priority set to P1 (unset → P1) on filing: this closes a real access-control gap for any self-hosted deployment reachable beyond localhost, and is one of two pieces scoped into the new 0.6.0 — Deployment Auth and Unified Search milestone.