Add stage 1: authentication REST API

Slim 4 + SQLite todo-list API providing email/password registration,
login, and an authenticated GET /me endpoint. Stateless HS256 JWTs,
bcrypt password hashing, uniform JSON error envelope, and a SQL
migration runner. Includes PHPUnit feature tests and stage-1 docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Repository/UserRepository.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Repository;
+
+use PDO;
+
+/**
+ * Data access for the `users` table. Rows are returned as associative arrays.
+ *
+ * @phpstan-type UserRow array{id: int, email: string, password_hash: string, created_at: string, updated_at: string}
+ */
+final class UserRepository
+{
+    public function __construct(private readonly PDO $pdo)
+    {
+    }
+
+    /**
+     * @return UserRow|null
+     */
+    public function findByEmail(string $email): ?array
+    {
+        $stmt = $this->pdo->prepare('SELECT * FROM users WHERE email = :email');
+        $stmt->execute(['email' => $email]);
+
+        $row = $stmt->fetch();
+
+        return $row === false ? null : $this->cast($row);
+    }
+
+    /**
+     * @return UserRow|null
+     */
+    public function findById(int $id): ?array
+    {
+        $stmt = $this->pdo->prepare('SELECT * FROM users WHERE id = :id');
+        $stmt->execute(['id' => $id]);
+
+        $row = $stmt->fetch();
+
+        return $row === false ? null : $this->cast($row);
+    }
+
+    /**
+     * @return UserRow
+     */
+    public function create(string $email, string $passwordHash): array
+    {
+        $stmt = $this->pdo->prepare(
+            'INSERT INTO users (email, password_hash) VALUES (:email, :password_hash)'
+        );
+        $stmt->execute([
+            'email' => $email,
+            'password_hash' => $passwordHash,
+        ]);
+
+        /** @var UserRow $user */
+        $user = $this->findById((int) $this->pdo->lastInsertId());
+
+        return $user;
+    }
+
+    /**
+     * @param array<string, mixed> $row
+     * @return UserRow
+     */
+    private function cast(array $row): array
+    {
+        $row['id'] = (int) $row['id'];
+
+        /** @var UserRow $row */
+        return $row;
+    }
+}