feat(auth): add DB-backed login, token management, and idempotent auth migration

app/services/user_service.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 from fastapi import Depends
 
 from app.core.config import Settings, get_settings
+from app.core.security import hash_password
 from app.domain.models import User
 from app.repositories.factory import get_portfolio_repository_from_settings
 from app.repositories.portfolio_repository import PortfolioRepository
@@ -26,13 +27,22 @@ class UserService:
         return self._repository.get_user(user_id)
 
     def create(self, payload: CreateUserRequest) -> User:
-        return self._repository.create_user(payload.username, email=payload.email)
+        return self._repository.create_user(
+            payload.username,
+            email=payload.email,
+            password_hash=hash_password(payload.password),
+            permission=payload.permission,
+            is_active=payload.is_active,
+        )
 
     def update(self, user_id: str, payload: UpdateUserRequest) -> User:
         return self._repository.update_user(
             user_id,
             username=payload.username,
             email=payload.email,
+            password_hash=hash_password(payload.password) if payload.password is not None else None,
+            permission=payload.permission,
+            is_active=payload.is_active,
         )
 
     def delete(self, user_id: str) -> None: