feat(auth): login, roles, user mgmt, setup wizard, and session guard

- New skald-setup crate: interactive first-run wizard that creates the
  admin user, prompts for encryption choice and password
- Auth system: session-based login/logout with cookie, guard middleware
- Roles API: CRUD for data-driven roles, seeded on first boot
- Users management API: create, list, edit, delete users
- Setup state API: check if first admin has been created
- Frontend: login-page, setup-page, users-page, roles-page, profile-page
  components with corresponding CSS
- Topbar: avatar dropdown with profile link and logout
- Sidebar: nav entries for Users and Roles (admin only)
- Page shell CSS: layout support for the new pages
- build.sh: builds both skald and skald-setup binaries
- run.sh: runs skald-setup before the server loop
- CLAUDE.md: updated workspace layout and build/run docs

build.sh

@@ -14,7 +14,6 @@ set -eu
 
 cd "$(dirname "$0")"
 
-BIN_NAME="skald"
 OUT_DIR="bin"
 
 PROFILE="release"
@@ -27,21 +26,30 @@ fi
 RUSTFLAGS="-A warnings"
 export RUSTFLAGS
 
+# The server takes any forwarded args (e.g. --features desktop); the setup wizard
+# is a plain binary and is always built on its own, without them.
 if [ "$PROFILE" = "release" ]; then
     cargo build --release "$@"
+    cargo build --release -p skald-setup
 else
     cargo build "$@"
+    cargo build -p skald-setup
 fi
 
-SRC="target/$PROFILE/$BIN_NAME"
-if [ ! -f "$SRC" ]; then
-    echo "[build.sh] Expected binary not found at $SRC" >&2
-    exit 1
-fi
+# Stage as .new and rename into place: a plain cp over a live binary fails with
+# ETXTBSY on Linux while run.sh supervises a running instance.
+install_bin() {
+    src="target/$PROFILE/$1"
+    if [ ! -f "$src" ]; then
+        echo "[build.sh] Expected binary not found at $src" >&2
+        exit 1
+    fi
+    cp "$src" "$OUT_DIR/$1.new"
+    chmod 755 "$OUT_DIR/$1.new"
+    mv -f "$OUT_DIR/$1.new" "$OUT_DIR/$1"
+    echo "[build.sh] $PROFILE build installed → $OUT_DIR/$1"
+}
 
 mkdir -p "$OUT_DIR"
-cp "$SRC" "$OUT_DIR/$BIN_NAME.new"
-chmod 755 "$OUT_DIR/$BIN_NAME.new"
-mv -f "$OUT_DIR/$BIN_NAME.new" "$OUT_DIR/$BIN_NAME"
-
-echo "[build.sh] $PROFILE build installed → $OUT_DIR/$BIN_NAME"
+install_bin skald
+install_bin skald-setup