Add stage 2: Vue/TypeScript PWA shell with auth-gated routing

Backend: new migration adds users.email_verified_at (null = unverified);
registration leaves it null, and the register/login/me payloads now expose
email_verified and email_verified_at.

Frontend (web/): Vite + Vue 3 + TypeScript PWA (vite-plugin-pwa). Pinia auth
store keeps the token in localStorage and validates it via GET /api/me on
load. vue-router guards redirect unauthenticated visitors to /login,
preserving the intended path; /register creates an account and signs in
immediately (with the email unverified). Placeholder home page, minimal
styling, generated icons. Dev server proxies /api to the API.

docker-compose.yml gains an optional "web" service (profile: frontend) so
`docker compose --profile frontend up -d` runs the dev server alongside the
API; `docker compose up -d` still starts the API alone.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/stores/auth.ts

@@ -0,0 +1,92 @@
+import { defineStore } from 'pinia'
+import { computed, ref } from 'vue'
+import { apiRequest, setAuthToken } from '../lib/api'
+import type { AuthResponse, User } from '../types'
+
+const TOKEN_KEY = 'todo.token'
+
+function readStoredToken(): string | null {
+  try {
+    return localStorage.getItem(TOKEN_KEY)
+  } catch {
+    return null
+  }
+}
+
+export const useAuthStore = defineStore('auth', () => {
+  const token = ref<string | null>(readStoredToken())
+  const user = ref<User | null>(null)
+  /** True until the initial `fetchMe()` on app start has settled. */
+  const loading = ref(false)
+
+  setAuthToken(token.value)
+
+  const isAuthenticated = computed(() => token.value !== null && user.value !== null)
+  const emailVerified = computed(() => user.value?.email_verified ?? false)
+
+  function setToken(value: string | null): void {
+    token.value = value
+    setAuthToken(value)
+    try {
+      if (value) localStorage.setItem(TOKEN_KEY, value)
+      else localStorage.removeItem(TOKEN_KEY)
+    } catch {
+      /* storage unavailable — session stays in memory only */
+    }
+  }
+
+  function adopt(response: AuthResponse): void {
+    setToken(response.token)
+    user.value = response.user
+  }
+
+  async function register(email: string, password: string): Promise<void> {
+    adopt(
+      await apiRequest<AuthResponse>('/auth/register', {
+        method: 'POST',
+        body: { email, password },
+      }),
+    )
+  }
+
+  async function login(email: string, password: string): Promise<void> {
+    adopt(
+      await apiRequest<AuthResponse>('/auth/login', {
+        method: 'POST',
+        body: { email, password },
+      }),
+    )
+  }
+
+  function logout(): void {
+    setToken(null)
+    user.value = null
+  }
+
+  /** Resolve the current user from a stored token; clears it if invalid. */
+  async function fetchMe(): Promise<void> {
+    if (!token.value) return
+
+    loading.value = true
+    try {
+      const { user: me } = await apiRequest<{ user: User }>('/me', { auth: true })
+      user.value = me
+    } catch {
+      logout()
+    } finally {
+      loading.value = false
+    }
+  }
+
+  return {
+    token,
+    user,
+    loading,
+    isAuthenticated,
+    emailVerified,
+    register,
+    login,
+    logout,
+    fetchMe,
+  }
+})