Cookie-based auth/authz with CSRF; remove auth bypass

Replace the dev-only token shim with real authentication.

Backend:
- @fastify/cookie; JWT carried in an HttpOnly + SameSite=Strict cookie
  (parking_token), read from the cookie not the Authorization header.
- Double-submit CSRF: readable parking_csrf cookie + X-CSRF-Token header, both
  cross-checked against a csrf claim baked into the JWT; enforced on mutations.
- Routes: POST /api/auth/login (bcrypt, constant-time-ish), POST logout,
  GET me. requireRole now verifies the cookie + CSRF + role.
- seed-admin script (pnpm --filter @parking/server seed-admin) for the first
  admin; no bootstrap endpoint.
- Removed SETUP_AUTH_BYPASS and catalog.authBypass entirely; setup endpoints
  use the cookie admin guard like everything else.

Frontend:
- apiFetch wrapper: credentials:'include' + X-CSRF-Token on mutations.
- Login form; App gates on /api/auth/me and only shows setup to admins; logout.
- Wizard token field removed (auth is the session cookie).

Deploy:
- deploy/nginx.conf: prod reverse proxy, SPA + /api same-origin, TLS, so the
  Secure cookies work. Dev stays same-origin via the Vite proxy.

Verified (curl + browser): wrong pass -> 401; login sets cookies; me -> admin;
assign without CSRF -> 403, with -> 201; no cookie -> 401; session persists
across reload. wiki/local-jwt-auth updated.

apps/server/scripts/seed-admin.mjs

@@ -0,0 +1,59 @@
+// Seed the first admin user (run once at install).
+//
+//   ADMIN_USER=admin ADMIN_PASS='strong-pass' \
+//     node --env-file-if-exists=.env apps/server/scripts/seed-admin.mjs
+//
+// Or interactively (prompts for a hidden password):
+//   node --env-file-if-exists=.env apps/server/scripts/seed-admin.mjs <username>
+//
+// Idempotent-ish: refuses to overwrite an existing user unless FORCE=1.
+
+import { randomUUID } from "node:crypto";
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const bcrypt = require("bcrypt");
+const { createDb, users, eq } = require("@parking/db");
+
+const username = process.env.ADMIN_USER ?? process.argv[2];
+let password = process.env.ADMIN_PASS;
+
+if (!username) {
+  console.error("usage: ADMIN_USER=.. ADMIN_PASS=.. seed-admin.mjs   (or pass a username arg)");
+  process.exit(1);
+}
+
+if (!password) {
+  const rl = createInterface({ input: stdin, output: stdout });
+  password = (await rl.question(`Password for "${username}": `)).trim();
+  rl.close();
+}
+if (!password || password.length < 8) {
+  console.error("password must be at least 8 characters");
+  process.exit(1);
+}
+
+const db = createDb();
+const existing = await db.select().from(users).where(eq(users.username, username)).get();
+if (existing && process.env.FORCE !== "1") {
+  console.error(`user "${username}" already exists (set FORCE=1 to reset the password)`);
+  process.exit(1);
+}
+
+const passwordHash = await bcrypt.hash(password, 12);
+
+if (existing) {
+  await db.update(users).set({ passwordHash, role: "admin" }).where(eq(users.id, existing.id));
+  console.log(`reset password for admin "${username}"`);
+} else {
+  await db.insert(users).values({
+    id: randomUUID(),
+    username,
+    passwordHash,
+    role: "admin",
+  });
+  console.log(`created admin "${username}"`);
+}
+process.exit(0);