WP-01: domain contract and failing tests for auth and user management

Domain entities/ports, service stubs, 18 application unit tests with in-memory
fakes, API integration tests for /api/auth and /api/users, Vitest specs for the
auth store, login page and user form, Playwright auth/user-management flow.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/application/src/auth_service.rs

@@ -0,0 +1,65 @@
+use std::sync::Arc;
+
+use chrono::Duration;
+use domain::auth::TokenPair;
+use domain::ports::{
+    AccessTokenIssuer, AuditLog, PasswordHasher, RefreshTokenRepository, UserRepository,
+};
+use domain::user::User;
+use domain::DomainError;
+
+pub const REFRESH_TOKEN_TTL_DAYS: i64 = 30;
+
+pub struct AuthService {
+    pub(crate) users: Arc<dyn UserRepository>,
+    pub(crate) refresh: Arc<dyn RefreshTokenRepository>,
+    pub(crate) audit: Arc<dyn AuditLog>,
+    pub(crate) hasher: Arc<dyn PasswordHasher>,
+    pub(crate) tokens: Arc<dyn AccessTokenIssuer>,
+    pub(crate) refresh_ttl: Duration,
+}
+
+impl AuthService {
+    pub fn new(
+        users: Arc<dyn UserRepository>,
+        refresh: Arc<dyn RefreshTokenRepository>,
+        audit: Arc<dyn AuditLog>,
+        hasher: Arc<dyn PasswordHasher>,
+        tokens: Arc<dyn AccessTokenIssuer>,
+    ) -> Self {
+        Self {
+            users,
+            refresh,
+            audit,
+            hasher,
+            tokens,
+            refresh_ttl: Duration::days(REFRESH_TOKEN_TTL_DAYS),
+        }
+    }
+
+    pub async fn login(
+        &self,
+        _email: &str,
+        _password: &str,
+        _ip: Option<String>,
+    ) -> Result<TokenPair, DomainError> {
+        todo!()
+    }
+
+    pub async fn refresh(
+        &self,
+        _refresh_token: &str,
+        _ip: Option<String>,
+    ) -> Result<TokenPair, DomainError> {
+        todo!()
+    }
+
+    pub async fn logout(&self, _refresh_token: &str) -> Result<(), DomainError> {
+        todo!()
+    }
+
+    /// Resolve the user behind an access token; fails for invalid tokens and inactive users.
+    pub async fn authenticate(&self, _access_token: &str) -> Result<User, DomainError> {
+        todo!()
+    }
+}