[S4.1-04] Implement Auth API v1 (register, login, logout, me)

[humanauction]

Labels: stage-4, backend, api, security
Depends on: S4.1-03

Acceptance Criteria:

• Register endpoint creates users with hashed passwords only.
• Login endpoint returns authenticated session per ADR.
• Logout endpoint invalidates session/token correctly.
• Me endpoint returns authenticated profile or proper 401.
• API tests cover happy path and failure path responses.