WP-01: domain contract and failing tests for auth and user management

Domain entities/ports, service stubs, 18 application unit tests with in-memory
fakes, API integration tests for /api/auth and /api/users, Vitest specs for the
auth store, login page and user form, Playwright auth/user-management flow.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/application/src/user_service.rs

@@ -0,0 +1,46 @@
+use std::sync::Arc;
+
+use domain::ports::{PasswordHasher, UserRepository};
+use domain::user::{NewUser, User, UserUpdate};
+use domain::DomainError;
+use uuid::Uuid;
+
+pub struct UserService {
+    pub(crate) users: Arc<dyn UserRepository>,
+    pub(crate) hasher: Arc<dyn PasswordHasher>,
+}
+
+impl UserService {
+    pub fn new(users: Arc<dyn UserRepository>, hasher: Arc<dyn PasswordHasher>) -> Self {
+        Self { users, hasher }
+    }
+
+    pub async fn list(&self) -> Result<Vec<User>, DomainError> {
+        todo!()
+    }
+
+    pub async fn get(&self, _id: Uuid) -> Result<User, DomainError> {
+        todo!()
+    }
+
+    pub async fn create(&self, _new: NewUser) -> Result<User, DomainError> {
+        todo!()
+    }
+
+    pub async fn update(&self, _id: Uuid, _update: UserUpdate) -> Result<User, DomainError> {
+        todo!()
+    }
+
+    pub async fn reset_password(&self, _id: Uuid, _password: &str) -> Result<(), DomainError> {
+        todo!()
+    }
+
+    /// Create the initial admin if the user table is empty. Returns true if created.
+    pub async fn bootstrap_admin(
+        &self,
+        _email: &str,
+        _password: &str,
+    ) -> Result<bool, DomainError> {
+        todo!()
+    }
+}