Auth and user work

[Drandel]

Summary

This PR implements full user registration and authentication for the KitchenSync backend and
frontend, including JWT-based access tokens, httpOnly refresh token cookies, and session
rehydration on app load.

Backend

• User registration (POST /user/register) — validates input via class-validator DTOs with a global
  ValidationPipe; checks email format, username/email uniqueness, and password strength before
  hashing with bcrypt and persisting to the DB
• Auth module — JWT access tokens (1hr expiry) + opaque refresh tokens (30 days) stored as SHA-256
  hashes in a new RefreshToken table
• POST /auth/login — validates credentials, issues access token in response body and refresh token
  as an httpOnly cookie
• POST /auth/refresh — validates and rotates the refresh token, returns a new access token
• POST /auth/logout — deletes the refresh token from the DB and clears the cookie
• JwtStrategy + JwtAuthGuard — Passport JWT strategy and guard for protecting future routes
• @currentuser decorator — extracts the authenticated user from req.user in controller methods
• Prisma migration — adds RefreshToken table with cascade delete on user removal
• Environment — split root .env into backend/.env and frontend/.env; updated docker-compose
  accordingly

Frontend

• Axios instance — configured with baseURL and withCredentials: true for automatic cookie handling
• AuthContext — manages in-memory access token and user state; silent refresh on app mount for
  session rehydration; request interceptor for automatic Authorization header attachment; response
  interceptor for transparent silent refresh on 401
• useLogin / useRegister — updated hooks using the new context; register automatically logs the
  user in after account creation
• ProtectedRoute — guards routes behind authentication; respects isLoading to prevent premature
  redirects
• NavBar — logout button shown when authenticated; redirects to /login on logout
• authPage — redirects to / on successful login or registration; clears errors and warnings when
  toggling between login and signup modes
• Router — migrated to explicit JSX syntax via createRoutesFromElements