Implement user authentication endpoints and database migration

[Barboud]

Add session-based authentication

• POST /auth/login - validates credentials, creates opaque UUID session, sets HttpOnly cookie
• POST /auth/logout - deletes session, clears cookie
• POST /auth/register - register a new user
• GET /auth/me - returns current user from session
• SessionAuthFilter - validates session cookie
• Static page (/index.html) for test login/register and logout functions