feat(M2): Authentication, Authorization & Frontend Shell

- pm-auth::password: Argon2id (m=65536,t=3,p=1) hashing + verification
- pm-auth::jwt: EdDSA/Ed25519 JWT issuance + validation (15-min TTL)
- pm-auth::refresh: Opaque 256-bit refresh tokens, SHA-256 hashed,
  1-hour sliding inactivity timeout, rotation on use, revocable
- pm-auth::mfa_totp: TOTP setup/verify (HMAC-SHA1, 6-digit, 30s)
  with otpauth:// URI generation (Google Authenticator compatible)
- pm-auth::mfa_webauthn: Stub (full implementation deferred)
- pm-auth::rbac: Axum middleware for JWT auth + IP whitelist +
  admin/operator role enforcement + FromRequestParts extractor
- pm-auth::session: Full login flow (password → MFA → tokens),
  token refresh, logout, force-logout
- pm-web auth routes: POST /api/v1/auth/login|refresh|logout,
  GET /api/v1/auth/mfa/setup, POST /api/v1/auth/mfa/verify
- IP whitelist middleware on all protected connection points
- migrations/002_seed_admin.sql: Default admin account seed
- Frontend: Auth store (Zustand with persistence), login page with
  MFA prompt, MFA setup page (stepper), JWT auto-refresh interceptor,
  route guards (RequireAuth), updated App.tsx routing
- cargo check --workspace: zero errors, 1 minor warning

Closes M2.

crates/pm-auth/src/lib.rs

@@ -1,10 +1,24 @@
 //! pm-auth — Authentication and authorization.
 //!
-//! Modules: password (Argon2id), jwt (EdDSA), refresh tokens,
-//! mfa_totp, mfa_webauthn, rbac, session.
-//!
-//! M1: Stub. Full implementation in M2.
-pub mod password;
+//! Modules:
+//! - `password` — Argon2id password hashing (m=65536, t=3, p=1)
+//! - `jwt` — EdDSA/Ed25519 JWT issuance and validation (15-min TTL)
+//! - `refresh` — Opaque 256-bit refresh tokens (1-hour sliding window)
+//! - `mfa_totp` — TOTP setup and verification (Google Authenticator compatible)
+//! - `mfa_webauthn` — WebAuthn stub (full implementation pending)
+//! - `rbac` — Axum middleware for JWT authentication and role enforcement
+//! - `session` — Login flow orchestration (password → MFA → tokens)
+
 pub mod jwt;
+pub mod mfa_totp;
+pub mod mfa_webauthn;
+pub mod password;
 pub mod rbac;
+pub mod refresh;
 pub mod session;
+
+// Commonly re-exported types
+pub use jwt::{AccessClaims, JwtError};
+pub use password::{hash_password, verify_password, PasswordError};
+pub use rbac::{AuthConfig, AuthUser, UserRole};
+pub use session::{LoginRequest, LoginResponse, SessionError, SessionUser};