Add stage 1: authentication REST API

Slim 4 + SQLite todo-list API providing email/password registration,
login, and an authenticated GET /me endpoint. Stateless HS256 JWTs,
bcrypt password hashing, uniform JSON error envelope, and a SQL
migration runner. Includes PHPUnit feature tests and stage-1 docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,14 @@
+# Copy to .env and adjust as needed. All values are optional and have sane
+# development defaults (see src/Support/Config.php).
+
+# Show full exception details in API error responses. Never enable in production.
+APP_DEBUG=false
+
+# Path to the SQLite database file (absolute, or relative to the project root).
+DATABASE_PATH=storage/database.sqlite
+
+# Secret used to sign JWTs. Leave blank to auto-generate one into storage/secret.key.
+JWT_SECRET=
+
+# How long an issued token stays valid, in seconds (default: 86400 = 24h).
+JWT_TTL=86400