WP-01: domain contract and failing tests for auth and user management

Domain entities/ports, service stubs, 18 application unit tests with in-memory
fakes, API integration tests for /api/auth and /api/users, Vitest specs for the
auth store, login page and user form, Playwright auth/user-management flow.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/api/tests/common/mod.rs

@@ -87,3 +87,28 @@ pub fn cookie_value(res: &Res, name: &str) -> Option<String> {
         .find(|c| c.starts_with(&format!("{name}=")))
         .map(|c| c.split(';').next().unwrap().to_string())
 }
+
+/// App with a bootstrapped admin `admin@example.com` / `admin-password-123`.
+pub async fn test_app_with_admin() -> Router {
+    api::test_support::build_test_app_with_admin("admin@example.com", "admin-password-123").await
+}
+
+pub struct Login {
+    pub access: String,
+    pub user_id: String,
+}
+
+pub async fn login(app: &Router, email: &str, password: &str) -> Login {
+    let res = post(
+        app,
+        "/api/auth/login",
+        serde_json::json!({"email": email, "password": password}),
+        None,
+    )
+    .await;
+    assert_eq!(res.status, StatusCode::OK, "login failed: {}", res.json);
+    Login {
+        access: res.json["access_token"].as_str().unwrap().to_string(),
+        user_id: res.json["user"]["id"].as_str().unwrap().to_string(),
+    }
+}