feat(auth): add session login page, API key guard, and remove orphan SQL migrations

- Add session-based authentication for web-UI (Login.vue, AuthController)
- Add AuthSessionMiddleware: redirects unauthenticated users to /login
- Add ApiKeyMiddleware: validates X-Api-Key header on all /api/v1 routes
- Add BasicAuthMiddleware: registered for future M2M use
- Use timingSafeEqual for all credential comparisons (timing attack prevention)
- Regenerate session ID on login (session fixation prevention)
- Validate redirect target after login (open redirect prevention)
- Require WEBUI_USERNAME, WEBUI_PASSWORD, API_KEY as mandatory env vars
- Share auth.username/authenticated via Inertia shared props
- Add user dropdown in navbar (avatar icon + username + logout)
- Add login i18n keys in fr.json and en.json
- Remove orphan SQL migrations (users, auth_access_tokens) and @adonisjs/lucid

database/base_model.ts

@@ -1,4 +1,11 @@
-import { Db, Collection, ObjectId, Filter, UpdateFilter, Sort } from 'mongodb'
+import {
+  type Db,
+  type Collection,
+  ObjectId,
+  type Filter,
+  type UpdateFilter,
+  type Sort,
+} from 'mongodb'
 import { getMongoDb } from '#providers/mongodb_provider'
 
 export abstract class BaseModel {
@@ -16,7 +23,10 @@ export abstract class BaseModel {
     return this.getDb().collection(this.collectionName)
   }
 
-  static async find(this: { collectionName: string; getDb(): Db }, filter: Filter<any> = {}): Promise<any[]> {
+  static async find(
+    this: { collectionName: string; getDb(): Db },
+    filter: Filter<any> = {}
+  ): Promise<any[]> {
     const collection = this.getDb().collection(this.collectionName)
     return collection.find(filter).toArray()
   }