feat(auth): add local login, audit, API keys, and system admin UI

Gate netx Web/API/WebCRT with JWT and per-user API tokens, bootstrap an admin with forced password change, and expose users/audit/API-key management under a System section. MCP can reuse data/auth/mcp_token without extra env for local labs.

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/main.tsx

@@ -7,6 +7,7 @@ import App from "./App.tsx";
 import { ErrorBoundary } from "./layout/ErrorBoundary";
 import { I18nProvider } from "./i18n";
 import { ToastProvider } from "./hooks/useToast";
+import { AuthProvider } from "./auth/AuthContext";
 
 const queryClient = new QueryClient();
 
@@ -17,7 +18,9 @@ createRoot(document.getElementById("root")!).render(
         <I18nProvider>
           <ToastProvider>
             <BrowserRouter>
-              <App />
+              <AuthProvider>
+                <App />
+              </AuthProvider>
             </BrowserRouter>
           </ToastProvider>
         </I18nProvider>