feat(auth): add DB-backed login, token management, and idempotent auth migration

app/cli/commands/user.py

@@ -20,7 +20,7 @@ def _with_service(ctx: typer.Context, callback):
     try:
         return execute_command(app_context.console, callback=lambda: callback(service, app_context))
     finally:
-        if hasattr(repository, "close"):
+        if callable(getattr(type(repository), "close", None)):
             repository.close()
 
 
@@ -29,8 +29,11 @@ def _to_user_response(user) -> UserResponse:
         id=user.id,
         username=user.username,
         email=user.email,
+        permission=user.permission,
+        is_active=user.is_active,
         created_at=user.created_at,
         updated_at=user.updated_at,
+        last_login_at=user.last_login_at,
     )
 
 
@@ -53,14 +56,25 @@ def get_user(
 def create_user(
     ctx: typer.Context,
     username: str = typer.Option(..., help="Username."),
+    password: str = typer.Option(..., help="Initial password."),
     email: str | None = typer.Option(None, help="Email address."),
+    permission: str = typer.Option("read", help="Permission: read, trade-write, admin."),
+    is_active: bool = typer.Option(True, help="Whether the user is active."),
     force: bool = typer.Option(False, "--force", help="Skip confirmation prompt."),
 ) -> None:
     _confirm(force, f"Create user {username}?")
     user = _with_service(
         ctx,
         lambda service, app_context: _to_user_response(
-            service.create(CreateUserRequest(username=username, email=email))
+            service.create(
+                CreateUserRequest(
+                    username=username,
+                    password=password,
+                    email=email,
+                    permission=permission,
+                    is_active=is_active,
+                )
+            )
         ),
     )
     render_output(ctx.obj.console, ctx.obj.output_format, user)
@@ -71,14 +85,26 @@ def update_user(
     ctx: typer.Context,
     user_id: str = typer.Argument(..., help="User identifier."),
     username: str | None = typer.Option(None, help="New username."),
+    password: str | None = typer.Option(None, help="New password."),
     email: str | None = typer.Option(None, help="New email address."),
+    permission: str | None = typer.Option(None, help="New permission."),
+    is_active: bool | None = typer.Option(None, help="Whether the user is active."),
     force: bool = typer.Option(False, "--force", help="Skip confirmation prompt."),
 ) -> None:
     _confirm(force, f"Update user {user_id}?")
     user = _with_service(
         ctx,
         lambda service, app_context: _to_user_response(
-            service.update(user_id, UpdateUserRequest(username=username, email=email))
+            service.update(
+                user_id,
+                UpdateUserRequest(
+                    username=username,
+                    password=password,
+                    email=email,
+                    permission=permission,
+                    is_active=is_active,
+                ),
+            )
         ),
     )
     render_output(ctx.obj.console, ctx.obj.output_format, user)