WP-01: domain contract and failing tests for auth and user management

Domain entities/ports, service stubs, 18 application unit tests with in-memory
fakes, API integration tests for /api/auth and /api/users, Vitest specs for the
auth store, login page and user form, Playwright auth/user-management flow.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/domain/src/error.rs

@@ -0,0 +1,21 @@
+use thiserror::Error;
+
+#[derive(Debug, Error, PartialEq, Eq)]
+pub enum DomainError {
+    #[error("not found")]
+    NotFound,
+    #[error("email already in use")]
+    EmailTaken,
+    #[error("invalid credentials")]
+    InvalidCredentials,
+    #[error("user is inactive")]
+    InactiveUser,
+    #[error("invalid or expired token")]
+    InvalidToken,
+    #[error("the last active admin cannot be demoted or deactivated")]
+    LastAdmin,
+    #[error("validation failed: {0}")]
+    Validation(String),
+    #[error("storage error: {0}")]
+    Storage(String),
+}