Authentication

Email/password sessions (JWT cookie) plus API keys hashed with SHA-256. Modular auth layer can be swapped for a hosted provider later.