feat(auth): login, roles, user mgmt, setup wizard, and session guard

- New skald-setup crate: interactive first-run wizard that creates the
  admin user, prompts for encryption choice and password
- Auth system: session-based login/logout with cookie, guard middleware
- Roles API: CRUD for data-driven roles, seeded on first boot
- Users management API: create, list, edit, delete users
- Setup state API: check if first admin has been created
- Frontend: login-page, setup-page, users-page, roles-page, profile-page
  components with corresponding CSS
- Topbar: avatar dropdown with profile link and logout
- Sidebar: nav entries for Users and Roles (admin only)
- Page shell CSS: layout support for the new pages
- build.sh: builds both skald and skald-setup binaries
- run.sh: runs skald-setup before the server loop
- CLAUDE.md: updated workspace layout and build/run docs

web/index.html

@@ -61,6 +61,8 @@
   <link rel="stylesheet" href="css/agent-inbox.css" />
   <link rel="stylesheet" href="css/home.css" />
   <link rel="stylesheet" href="css/llm-requests.css" />
+  <link rel="stylesheet" href="css/setup-page.css" />
+  <link rel="stylesheet" href="css/users-roles.css" />
   <link rel="stylesheet" href="css/projects/base.css" />
   <link rel="stylesheet" href="css/projects/board.css" />
   <link rel="stylesheet" href="css/file-viewer.css" />
@@ -88,6 +90,9 @@
       <app-sidebar></app-sidebar>
       <div class="app-workspace" id="app-workspace"></div>
       <agents-page></agents-page>
+      <users-page></users-page>
+      <roles-page></roles-page>
+      <profile-page style="display:none"></profile-page>
       <llm-providers-page></llm-providers-page>
       <models-hub-page></models-hub-page>
       <tasks-page></tasks-page>
@@ -105,6 +110,9 @@
     </div>
   </div>
 
+  <setup-page style="display:none"></setup-page>
+  <login-page style="display:none"></login-page>
+
   <script type="module" src="app.js"></script>
 </body>
 </html>