feat(auth): add DB-backed login, token management, and idempotent auth migration

app/schemas/user.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from datetime import datetime
+from typing import Literal
 
 from pydantic import BaseModel, Field, field_validator
 
@@ -11,13 +12,19 @@ class UserResponse(BaseModel):
     id: str
     username: str
     email: str | None = None
+    permission: Literal["read", "trade-write", "admin"] = "read"
+    is_active: bool = True
     created_at: datetime | None = None
     updated_at: datetime | None = None
+    last_login_at: datetime | None = None
 
 
 class CreateUserRequest(BaseModel):
     username: str = Field(min_length=1)
     email: str | None = None
+    password: str = Field(min_length=8)
+    permission: Literal["read", "trade-write", "admin"] = "read"
+    is_active: bool = True
 
     @field_validator("username")
     @classmethod
@@ -39,6 +46,9 @@ class CreateUserRequest(BaseModel):
 class UpdateUserRequest(BaseModel):
     username: str | None = Field(default=None, min_length=1)
     email: str | None = None
+    password: str | None = Field(default=None, min_length=8)
+    permission: Literal["read", "trade-write", "admin"] | None = None
+    is_active: bool | None = None
 
     @field_validator("username")
     @classmethod