feat(auth): login, roles, user mgmt, setup wizard, and session guard

- New skald-setup crate: interactive first-run wizard that creates the
  admin user, prompts for encryption choice and password
- Auth system: session-based login/logout with cookie, guard middleware
- Roles API: CRUD for data-driven roles, seeded on first boot
- Users management API: create, list, edit, delete users
- Setup state API: check if first admin has been created
- Frontend: login-page, setup-page, users-page, roles-page, profile-page
  components with corresponding CSS
- Topbar: avatar dropdown with profile link and logout
- Sidebar: nav entries for Users and Roles (admin only)
- Page shell CSS: layout support for the new pages
- build.sh: builds both skald and skald-setup binaries
- run.sh: runs skald-setup before the server loop
- CLAUDE.md: updated workspace layout and build/run docs

crates/skald-setup/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "skald-setup"
+version = "0.1.0"
+edition = "2024"
+
+# Guided first-run setup: a thin terminal shell over `skald-core`. Deliberately
+# separate from the server binary so a richer installer (a GUI later) can be a
+# third shell over the same `UserManager`, and so the server never links the
+# TTY-prompt dependencies. It is a *frontend* on provisioning — all the real work
+# (envelope, file+row ordering, rollback) lives in `UserManager::register_user`.
+
+[[bin]]
+name = "skald-setup"
+path = "src/main.rs"
+
+[dependencies]
+skald-core = { path = "../skald-core" }
+tokio      = { version = "1", features = ["macros", "rt-multi-thread"] }
+anyhow     = "1"
+# Reads a password without echoing it to the terminal.
+rpassword  = "7"