Cookie-based auth/authz with CSRF; remove auth bypass

Replace the dev-only token shim with real authentication.

Backend:
- @fastify/cookie; JWT carried in an HttpOnly + SameSite=Strict cookie
  (parking_token), read from the cookie not the Authorization header.
- Double-submit CSRF: readable parking_csrf cookie + X-CSRF-Token header, both
  cross-checked against a csrf claim baked into the JWT; enforced on mutations.
- Routes: POST /api/auth/login (bcrypt, constant-time-ish), POST logout,
  GET me. requireRole now verifies the cookie + CSRF + role.
- seed-admin script (pnpm --filter @parking/server seed-admin) for the first
  admin; no bootstrap endpoint.
- Removed SETUP_AUTH_BYPASS and catalog.authBypass entirely; setup endpoints
  use the cookie admin guard like everything else.

Frontend:
- apiFetch wrapper: credentials:'include' + X-CSRF-Token on mutations.
- Login form; App gates on /api/auth/me and only shows setup to admins; logout.
- Wizard token field removed (auth is the session cookie).

Deploy:
- deploy/nginx.conf: prod reverse proxy, SPA + /api same-origin, TLS, so the
  Secure cookies work. Dev stays same-origin via the Vite proxy.

Verified (curl + browser): wrong pass -> 401; login sets cookies; me -> admin;
assign without CSRF -> 403, with -> 201; no cookie -> 401; session persists
across reload. wiki/local-jwt-auth updated.

apps/server/.env.example

@@ -13,11 +13,8 @@ JWT_SECRET=
 # HOST=0.0.0.0                 # interface to bind. 127.0.0.1 = loopback only.
 # LOG_LEVEL=info
 # DATABASE_URL=./parking.sqlite
+# NODE_ENV=production          # set in prod: makes auth cookies Secure (HTTPS-only)
 
-# Testing-only ------------------------------------------------------------
-# Bypass the admin auth on /api/setup/* so you can discover/assign devices
-# before the login flow exists. HARDENED: only honoured when NODE_ENV is not
-# "production" AND HOST is loopback (127.0.0.1 / ::1 / localhost); otherwise
-# the server refuses to start. Never set this in production.
-# SETUP_AUTH_BYPASS=1
-# HOST=127.0.0.1
+# First admin (seed once): pnpm --filter @parking/server seed-admin
+# ADMIN_USER=admin
+# ADMIN_PASS=