feat(auth): add DB-backed login, token management, and idempotent auth migration

app/domain/models.py

@@ -21,8 +21,34 @@ class User:
     id: str
     username: str
     email: str | None = None
+    permission: str = "read"
+    is_active: bool = True
+    password_hash: str | None = None
     created_at: datetime | None = None
     updated_at: datetime | None = None
+    last_login_at: datetime | None = None
+
+
+@dataclass
+class AuthToken:
+    id: str
+    user_id: str
+    name: str
+    token_prefix: str
+    permission: str
+    token_type: str
+    expires_at: datetime | None = None
+    last_used_at: datetime | None = None
+    revoked_at: datetime | None = None
+    created_at: datetime | None = None
+
+
+@dataclass
+class TokenPrincipal:
+    token_id: str
+    user_id: str
+    permission: str
+    token_type: str
 
 
 @dataclass