feat(gui): add auth core, setup gate, and first-run operator creation

- Add migrations 007-010 for system config, operators, sessions, audit_log
- Implement argon2id password hashing via argon2-cffi
- Implement session-based authentication with database-stored tokens
- Add SetupGateMiddleware to redirect to /setup until first operator created
- Add SessionMiddleware to load session from cookie and attach operator
- Create /setup, /login, /logout, /change-password routes with CSRF protection
- Add periodic session cleanup task (hourly)
- Add audit logging for auth events
- Update systemd unit with EnvironmentFile for /etc/central/central.env
- Add comprehensive tests for auth, middleware, and audit modules

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

sql/migrations/007_add_config_system.sql

@@ -0,0 +1,21 @@
+-- Migration 007: Add config.system table for global settings
+-- Idempotent per docs/migrations.md
+
+CREATE TABLE IF NOT EXISTS config.system (
+    id BOOLEAN PRIMARY KEY DEFAULT true CHECK (id = true),
+    setup_complete BOOLEAN NOT NULL DEFAULT false,
+    session_lifetime_days INTEGER NOT NULL DEFAULT 90,
+    map_tile_url TEXT NOT NULL DEFAULT 'https://tile.openstreetmap.org/{z}/{x}/{y}.png',
+    map_attribution TEXT NOT NULL DEFAULT '© OpenStreetMap contributors',
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Reuse existing set_updated_at trigger function
+DROP TRIGGER IF EXISTS system_set_updated_at ON config.system;
+CREATE TRIGGER system_set_updated_at
+    BEFORE UPDATE ON config.system
+    FOR EACH ROW
+    EXECUTE FUNCTION config.set_updated_at();
+
+-- Seed single row
+INSERT INTO config.system (id) VALUES (true) ON CONFLICT DO NOTHING;