Add stage 1: authentication REST API

Slim 4 + SQLite todo-list API providing email/password registration,
login, and an authenticated GET /me endpoint. Stateless HS256 JWTs,
bcrypt password hashing, uniform JSON error envelope, and a SQL
migration runner. Includes PHPUnit feature tests and stage-1 docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Http/Controllers/Controller.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers;
+
+use Psr\Http\Message\ResponseInterface as Response;
+
+/**
+ * Shared helpers for HTTP controllers.
+ */
+abstract class Controller
+{
+    /**
+     * Write a JSON body and return the response with the appropriate headers.
+     *
+     * @param array<string, mixed> $data
+     */
+    protected function json(Response $response, array $data, int $status = 200): Response
+    {
+        $response->getBody()->write(
+            (string) json_encode($data, JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT)
+        );
+
+        return $response
+            ->withHeader('Content-Type', 'application/json')
+            ->withStatus($status);
+    }
+}