Add session-based authentication with login/logout

- Users and sessions tables (Argon2 password hashing, SHA-256 session tokens)
- Server hooks validate session cookie on every request
- (app) routes redirect to /login if not authenticated
- Login page with email/password, styled matching budget app
- Logout via POST form action (invalidates session)
- User display name and sign out button in header
- create-user CLI script: npm run create-user <email> <password> [name]
- 30-day sessions with auto-refresh after 15 days

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

package.json

@@ -11,10 +11,15 @@
 		"db:generate": "drizzle-kit generate",
 		"db:migrate": "drizzle-kit migrate",
 		"db:push": "drizzle-kit push",
-		"db:studio": "drizzle-kit studio"
+		"db:studio": "drizzle-kit studio",
+		"create-user": "tsx scripts/create-user.ts"
 	},
 	"dependencies": {
+		"@node-rs/argon2": "^2.0.2",
+		"@oslojs/crypto": "^1.0.1",
+		"@oslojs/encoding": "^1.1.0",
 		"date-fns": "^4.1.0",
+		"dotenv": "^17.4.1",
 		"drizzle-orm": "^0.38.4",
 		"pg": "^8.13.1",
 		"qrcode": "^1.5.4",
@@ -32,6 +37,7 @@
 		"svelte": "^5.19.0",
 		"svelte-check": "^4.1.4",
 		"tailwindcss": "^4.1.3",
+		"tsx": "^4.21.0",
 		"typescript": "^5.7.3",
 		"vite": "^6.1.0"
 	}