feat: add tRPC auth context, middleware, and protected procedures

- Install jose (JWT) and bcryptjs (password hashing) dependencies
- Create auth utilities: JWT sign/verify, password hash/verify, session management
- Create createTRPCContext that extracts auth from session cookie, Bearer JWT, or x-api-key
- Add publicProcedure, protectedProcedure, adminProcedure, rateLimitedProcedure with middleware
- Wire context builder into SolidStart tRPC API handler
- Update tRPC client to inject auth tokens and handle 401 redirects
- Add unit tests for JWT, password, context builder, and middleware

web/package.json

@@ -23,7 +23,9 @@
     "@trpc/server": "^10.45.2",
     "@types/three": "^0.184.1",
     "@typeschema/valibot": "^0.13.4",
+    "bcryptjs": "^3.0.3",
     "drizzle-orm": "^0.45.2",
+    "jose": "^5",
     "pg": "^8.21.0",
     "solid-js": "^1.9.5",
     "tailwindcss": "^4.0.0",