feat(auth): add session login page, API key guard, and remove orphan SQL migrations

- Add session-based authentication for web-UI (Login.vue, AuthController)
- Add AuthSessionMiddleware: redirects unauthenticated users to /login
- Add ApiKeyMiddleware: validates X-Api-Key header on all /api/v1 routes
- Add BasicAuthMiddleware: registered for future M2M use
- Use timingSafeEqual for all credential comparisons (timing attack prevention)
- Regenerate session ID on login (session fixation prevention)
- Validate redirect target after login (open redirect prevention)
- Require WEBUI_USERNAME, WEBUI_PASSWORD, API_KEY as mandatory env vars
- Share auth.username/authenticated via Inertia shared props
- Add user dropdown in navbar (avatar icon + username + logout)
- Add login i18n keys in fr.json and en.json
- Remove orphan SQL migrations (users, auth_access_tokens) and @adonisjs/lucid

.env.example

@@ -29,3 +29,10 @@ LOG_PROTOCOL=udp4
 
 # Security
 HASH_KEY=0123456789abcdef0123456789abcdef
+
+# Web UI Basic Auth (browser prompt)
+WEBUI_USERNAME=Admin
+WEBUI_PASSWORD=Grenoble:38
+
+# REST API Key (set in X-Api-Key header)
+API_KEY=change-me-with-a-strong-random-key