feat(auth): add session login page, API key guard, and remove orphan SQL migrations

- Add session-based authentication for web-UI (Login.vue, AuthController)
- Add AuthSessionMiddleware: redirects unauthenticated users to /login
- Add ApiKeyMiddleware: validates X-Api-Key header on all /api/v1 routes
- Add BasicAuthMiddleware: registered for future M2M use
- Use timingSafeEqual for all credential comparisons (timing attack prevention)
- Regenerate session ID on login (session fixation prevention)
- Validate redirect target after login (open redirect prevention)
- Require WEBUI_USERNAME, WEBUI_PASSWORD, API_KEY as mandatory env vars
- Share auth.username/authenticated via Inertia shared props
- Add user dropdown in navbar (avatar icon + username + logout)
- Add login i18n keys in fr.json and en.json
- Remove orphan SQL migrations (users, auth_access_tokens) and @adonisjs/lucid

start/kernel.ts

@@ -20,4 +20,10 @@ router.use([
 export const middleware = router.named({
   cwmpLogger: () => import('#middleware/cwmp_logger_middleware'),
   cwmp: () => import('#middleware/cwmp_middleware'),
+  // basicAuth: available for machine-to-machine Basic Auth access if needed in the future
+  basicAuth: () => import('#middleware/basic_auth_middleware'),
+  // apiKey: protects all /api/v1 routes (X-Api-Key header)
+  apiKey: () => import('#middleware/api_key_middleware'),
+  // authSession: protects all web-ui routes (session-based login page)
+  authSession: () => import('#middleware/auth_session_middleware'),
 })