Add stage 1: authentication REST API

Slim 4 + SQLite todo-list API providing email/password registration,
login, and an authenticated GET /me endpoint. Stateless HS256 JWTs,
bcrypt password hashing, uniform JSON error envelope, and a SQL
migration runner. Includes PHPUnit feature tests and stage-1 docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/bootstrap.php

@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Auth\AuthMiddleware;
+use App\Auth\JwtService;
+use App\Http\Controllers\AuthController;
+use App\Http\JsonErrorHandler;
+use App\Repository\UserRepository;
+use App\Support\Config;
+use App\Support\Database;
+use Psr\Http\Message\ResponseInterface as Response;
+use Psr\Http\Message\ServerRequestInterface as Request;
+use Slim\Factory\AppFactory;
+use Slim\Routing\RouteCollectorProxy;
+
+$config = Config::load(dirname(__DIR__));
+$database = new Database($config->databasePath);
+
+$app = AppFactory::create();
+
+$app->addBodyParsingMiddleware();
+$app->addRoutingMiddleware();
+
+$errorMiddleware = $app->addErrorMiddleware($config->displayErrors, true, true);
+$errorMiddleware->setDefaultErrorHandler(
+    new JsonErrorHandler($app->getResponseFactory(), $config->displayErrors)
+);
+
+// --- Wiring -----------------------------------------------------------------
+
+$users = new UserRepository($database->pdo());
+$jwt = new JwtService($config->jwtSecret, $config->jwtTtl);
+
+$authController = new AuthController($users, $jwt);
+$authMiddleware = new AuthMiddleware($jwt, $users);
+
+// --- Routes ---------------------------------------------------------------
+
+$app->group('/api', function (RouteCollectorProxy $group) use ($authController, $authMiddleware) {
+    $group->get('/health', function (Request $request, Response $response): Response {
+        $response->getBody()->write((string) json_encode(['status' => 'ok']));
+        return $response->withHeader('Content-Type', 'application/json');
+    });
+
+    $group->post('/auth/register', [$authController, 'register']);
+    $group->post('/auth/login', [$authController, 'login']);
+
+    $group->get('/me', [$authController, 'me'])->add($authMiddleware);
+});
+
+return $app;