feat(auth): add local login, audit, API keys, and system admin UI

Gate netx Web/API/WebCRT with JWT and per-user API tokens, bootstrap an admin with forced password change, and expose users/audit/API-key management under a System section. MCP can reuse data/auth/mcp_token without extra env for local labs.

Co-authored-by: Cursor <cursoragent@cursor.com>

netx_api/auth_passwords.py

@@ -0,0 +1,20 @@
+"""Password hashing helpers (bcrypt)."""
+
+from __future__ import annotations
+
+import bcrypt
+
+
+def hash_password(password: str) -> str:
+    raw = str(password or "").encode("utf-8")
+    return bcrypt.hashpw(raw, bcrypt.gensalt()).decode("ascii")
+
+
+def verify_password(password: str, password_hash: str) -> bool:
+    try:
+        return bcrypt.checkpw(
+            str(password or "").encode("utf-8"),
+            str(password_hash or "").encode("ascii"),
+        )
+    except Exception:
+        return False