Add stage 2: Vue/TypeScript PWA shell with auth-gated routing

Backend: new migration adds users.email_verified_at (null = unverified);
registration leaves it null, and the register/login/me payloads now expose
email_verified and email_verified_at.

Frontend (web/): Vite + Vue 3 + TypeScript PWA (vite-plugin-pwa). Pinia auth
store keeps the token in localStorage and validates it via GET /api/me on
load. vue-router guards redirect unauthenticated visitors to /login,
preserving the intended path; /register creates an account and signs in
immediately (with the email unverified). Placeholder home page, minimal
styling, generated icons. Dev server proxies /api to the API.

docker-compose.yml gains an optional "web" service (profile: frontend) so
`docker compose --profile frontend up -d` runs the dev server alongside the
API; `docker compose up -d` still starts the API alone.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/views/HomeView.vue

@@ -0,0 +1,35 @@
+<script setup lang="ts">
+import { useAuthStore } from '../stores/auth'
+
+const auth = useAuthStore()
+</script>
+
+<template>
+  <section class="card">
+    <h1>Your todo list</h1>
+    <p class="muted">
+      Placeholder page. The list and its items arrive in the next stage — for now
+      this screen just proves you are authenticated against the REST API.
+    </p>
+
+    <div v-if="!auth.emailVerified" class="notice">
+      Your email address <strong>{{ auth.user?.email }}</strong> has not been
+      verified yet. Verification will be added in a later stage.
+    </div>
+
+    <dl class="facts">
+      <div>
+        <dt>Signed in as</dt>
+        <dd>{{ auth.user?.email }}</dd>
+      </div>
+      <div>
+        <dt>Account created</dt>
+        <dd>{{ auth.user?.created_at ?? '—' }}</dd>
+      </div>
+      <div>
+        <dt>Email verified</dt>
+        <dd>{{ auth.emailVerified ? 'yes' : 'no' }}</dd>
+      </div>
+    </dl>
+  </section>
+</template>

web/src/views/LoginView.vue

@@ -0,0 +1,65 @@
+<script setup lang="ts">
+import { ref } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
+import { ApiError } from '../lib/api'
+import { useAuthStore } from '../stores/auth'
+
+const auth = useAuthStore()
+const router = useRouter()
+const route = useRoute()
+
+const email = ref('')
+const password = ref('')
+const error = ref<ApiError | null>(null)
+const submitting = ref(false)
+
+async function onSubmit() {
+  submitting.value = true
+  error.value = null
+  try {
+    await auth.login(email.value, password.value)
+    const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : '/'
+    await router.push(redirect)
+  } catch (e) {
+    error.value = e instanceof ApiError ? e : new ApiError('Something went wrong.', 0)
+  } finally {
+    submitting.value = false
+  }
+}
+</script>
+
+<template>
+  <section class="card">
+    <h1>Log in</h1>
+
+    <form class="form" @submit.prevent="onSubmit">
+      <label>
+        <span>Email</span>
+        <input v-model="email" type="email" autocomplete="email" required />
+        <small v-if="error?.fieldError('email')" class="field-error">
+          {{ error.fieldError('email') }}
+        </small>
+      </label>
+
+      <label>
+        <span>Password</span>
+        <input v-model="password" type="password" autocomplete="current-password" required />
+        <small v-if="error?.fieldError('password')" class="field-error">
+          {{ error.fieldError('password') }}
+        </small>
+      </label>
+
+      <p v-if="error && Object.keys(error.details).length === 0" class="form-error">
+        {{ error.message }}
+      </p>
+
+      <button type="submit" :disabled="submitting">
+        {{ submitting ? 'Logging in…' : 'Log in' }}
+      </button>
+    </form>
+
+    <p class="muted">
+      No account? <RouterLink to="/register">Create one</RouterLink>.
+    </p>
+  </section>
+</template>

web/src/views/RegisterView.vue

@@ -0,0 +1,75 @@
+<script setup lang="ts">
+import { ref } from 'vue'
+import { useRouter } from 'vue-router'
+import { ApiError } from '../lib/api'
+import { useAuthStore } from '../stores/auth'
+
+const auth = useAuthStore()
+const router = useRouter()
+
+const email = ref('')
+const password = ref('')
+const error = ref<ApiError | null>(null)
+const submitting = ref(false)
+
+async function onSubmit() {
+  submitting.value = true
+  error.value = null
+  try {
+    await auth.register(email.value, password.value)
+    // Registration signs the user straight in (with an unverified email).
+    await router.push('/')
+  } catch (e) {
+    error.value = e instanceof ApiError ? e : new ApiError('Something went wrong.', 0)
+  } finally {
+    submitting.value = false
+  }
+}
+</script>
+
+<template>
+  <section class="card">
+    <h1>Create an account</h1>
+    <p class="muted">
+      You will be signed in immediately. Your email address starts out
+      unverified.
+    </p>
+
+    <form class="form" @submit.prevent="onSubmit">
+      <label>
+        <span>Email</span>
+        <input v-model="email" type="email" autocomplete="email" required />
+        <small v-if="error?.fieldError('email')" class="field-error">
+          {{ error.fieldError('email') }}
+        </small>
+      </label>
+
+      <label>
+        <span>Password</span>
+        <input
+          v-model="password"
+          type="password"
+          autocomplete="new-password"
+          minlength="8"
+          required
+        />
+        <small v-if="error?.fieldError('password')" class="field-error">
+          {{ error.fieldError('password') }}
+        </small>
+        <small v-else class="hint">At least 8 characters.</small>
+      </label>
+
+      <p v-if="error && Object.keys(error.details).length === 0" class="form-error">
+        {{ error.message }}
+      </p>
+
+      <button type="submit" :disabled="submitting">
+        {{ submitting ? 'Creating…' : 'Create account' }}
+      </button>
+    </form>
+
+    <p class="muted">
+      Already registered? <RouterLink to="/login">Log in</RouterLink>.
+    </p>
+  </section>
+</template>