feat(auth): add session login page, API key guard, and remove orphan SQL migrations

- Add session-based authentication for web-UI (Login.vue, AuthController)
- Add AuthSessionMiddleware: redirects unauthenticated users to /login
- Add ApiKeyMiddleware: validates X-Api-Key header on all /api/v1 routes
- Add BasicAuthMiddleware: registered for future M2M use
- Use timingSafeEqual for all credential comparisons (timing attack prevention)
- Regenerate session ID on login (session fixation prevention)
- Validate redirect target after login (open redirect prevention)
- Require WEBUI_USERNAME, WEBUI_PASSWORD, API_KEY as mandatory env vars
- Share auth.username/authenticated via Inertia shared props
- Add user dropdown in navbar (avatar icon + username + logout)
- Add login i18n keys in fr.json and en.json
- Remove orphan SQL migrations (users, auth_access_tokens) and @adonisjs/lucid

app/middleware/auth_session_middleware.ts

@@ -0,0 +1,25 @@
+import type { HttpContext } from '@adonisjs/core/http'
+import type { NextFn } from '@adonisjs/core/types/http'
+
+/**
+ * AuthSessionMiddleware
+ *
+ * Protects web-ui routes by requiring an authenticated session.
+ * If the session is not authenticated, stores the requested URL
+ * in the session and redirects to /login.
+ *
+ * Login is handled by AuthController + session-based authentication.
+ */
+export default class AuthSessionMiddleware {
+  async handle({ session, request, response }: HttpContext, next: NextFn) {
+    if (!session.get('authenticated')) {
+      // Remember where the user wanted to go
+      if (request.method() === 'GET') {
+        session.put('redirectAfterLogin', request.url())
+      }
+      return response.redirect().toPath('/login')
+    }
+
+    return next()
+  }
+}