feat: add JWT session management with refresh tokens and CSRF protection

[No-bodyq]

What this does

Adds proper JWT-based session management so users stay logged in for 24 hours without being asked to re-authenticate.

• Short-lived access tokens (15 min) + refresh tokens (24 hrs) with automatic rotation
• Wallet connect auth via Stellar challenge/signature flow
• CSRF protection on all mutating endpoints
• Session revocation — users can view and kill individual sessions
• Passwords are now actually stored and verified (was a stub before)
• Moved routes to src/app/api/ so Next.js can actually serve them

Testing

1. npm run dev
2. POST /api/auth/register → save csrfToken from response
3. POST /api/auth/refresh → rotates tokens, returns new csrfToken
4. GET /api/auth/sessions → lists active sessions
5. DELETE /api/auth/sessions with X-CSRF-Token header → revokes a session

Closes #12