Add login-required user management (admin/user roles, Config->Benutzer)

No self-signup: admins create every account in Config -> Benutzer with a
typed start password; a forced password change gates first use. Session-
cookie auth protects all /api/* routes; /api/users additionally requires
the admin role. See docs/authentication.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

AGENTS.md

@@ -36,6 +36,13 @@ It must support circuits, device rows, project devices, drag-and-drop restructur
 - General Circuit, CircuitDeviceRow, CircuitList and DistributionBoard
   repositories expose only active reads. Runtime writes belong in typed command
   repositories; direct integration fixtures belong under `tests/support`.
+- Authentication: session-cookie login with two fixed roles (`admin`, `user`),
+  no self-signup. `src/server/auth/*` (password hashing, sessions, Express
+  middleware), `src/domain/services/user.service.ts`,
+  `src/db/repositories/user.repository.ts`. Every `/api/*` route requires a
+  signed-in user (`src/server/index.ts`); `/api/users/*` additionally
+  requires `admin`. Frontend gate: `AuthProvider` + `LoginGate`
+  (`src/app/layout.tsx`). See `docs/authentication.md` for the full picture.
 
 The supported runtime model is Circuit-First. The former Consumer UI, API,
 tables and upgrade tooling are removed; do not reintroduce them.
@@ -704,6 +711,10 @@ for the early-phase power balance by DIN 276 cost group (see
 - logical feed link between distribution boards (`fedFrom` stays free text
   until the project owner decides whether it references a board, a feeding
   circuit or both) and the resulting hierarchical power summation
+- configurable role/rights matrix instead of the fixed `admin`/`user` roles
+- account lockout after failed login attempts
+- email/one-time-link password provisioning, OIDC/Entra login
+- linking user accounts to a personnel/employee master table
 
 Do not implement these while working on an unrelated phase.