feat(auth): login, roles, user mgmt, setup wizard, and session guard

- New skald-setup crate: interactive first-run wizard that creates the
  admin user, prompts for encryption choice and password
- Auth system: session-based login/logout with cookie, guard middleware
- Roles API: CRUD for data-driven roles, seeded on first boot
- Users management API: create, list, edit, delete users
- Setup state API: check if first admin has been created
- Frontend: login-page, setup-page, users-page, roles-page, profile-page
  components with corresponding CSS
- Topbar: avatar dropdown with profile link and logout
- Sidebar: nav entries for Users and Roles (admin only)
- Page shell CSS: layout support for the new pages
- build.sh: builds both skald and skald-setup binaries
- run.sh: runs skald-setup before the server loop
- CLAUDE.md: updated workspace layout and build/run docs

web/css/page-shell.css

@@ -71,6 +71,18 @@ file-viewer-page {
   border-right: 1px solid var(--toolbar-border, #e5e9f0);
 }
 
+users-page,
+roles-page,
+profile-page {
+  display: none; /* toggled by JS */
+  flex-direction: column;
+  flex: 1;
+  min-width: 0;
+  min-height: 0;
+  overflow: hidden;
+  border-right: 1px solid var(--toolbar-border, #e5e9f0);
+}
+
 /* ── Workspace placeholder ──────────────────────────────────────────────────── */
 
 .app-workspace {