feat: add tRPC auth context, middleware, and protected procedures

- Install jose (JWT) and bcryptjs (password hashing) dependencies
- Create auth utilities: JWT sign/verify, password hash/verify, session management
- Create createTRPCContext that extracts auth from session cookie, Bearer JWT, or x-api-key
- Add publicProcedure, protectedProcedure, adminProcedure, rateLimitedProcedure with middleware
- Wire context builder into SolidStart tRPC API handler
- Update tRPC client to inject auth tokens and handle 401 redirects
- Add unit tests for JWT, password, context builder, and middleware

web/src/routes/api/trpc/[trpc].ts

@@ -1,18 +1,15 @@
 import type { APIEvent } from "@solidjs/start/server";
 import { fetchRequestHandler } from "@trpc/server/adapters/fetch";
 import { appRouter } from "~/server/api/root";
+import { createTRPCContext } from "~/server/api/trpc";
 
 const handler = (event: APIEvent) =>
-  // adapts tRPC to fetch API style requests
   fetchRequestHandler({
-    // the endpoint handling the requests
     endpoint: "/api/trpc",
-    // the request object
     req: event.request,
-    // the router for handling the requests
     router: appRouter,
-    // any arbitrary data that should be available to all actions
-    createContext:  () => event
+    createContext: ({ req, resHeaders }) =>
+      createTRPCContext({ req, resHeaders }),
   });
 
 export const GET = handler;