Add auth, JWT tokens, and bootstrap startup

Introduce bootstrap entrypoint and prestartup to ping DB and generate/manage RSA keypair. Add security module for key IO. Implement JWT-based access and refresh tokens (tokensService) with refresh_tokens table and repo. Add auth, provider and user services, and refresh-token management. Update repositories (users, credentials, providers, servers) with SQL fixes and new helper methods. Move DDL execution to bootstrap (remove from server). Update package.json main and add dependencies (bcryptjs, jsonwebtoken). Update .env.example and .gitignore accordingly.

data/ddl/01_users.sql

@@ -1,8 +1,9 @@
 CREATE TABLE IF NOT EXISTS `users` (
     `id` UUID PRIMARY KEY DEFAULT UUID(),
     `serverId` UUID NULL,
+    `identifier` VARCHAR(255) NOT NULL UNIQUE,
     `remoteId` VARCHAR(255) NULL,
-    `displayName` VARCHAR(255) NOT NULL,
+    `displayName` VARCHAR(512) NOT NULL,
     `avatarUrl` TEXT NULL,
     `createdAt` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
 

data/ddl/05_tokens.sql

@@ -0,0 +1,7 @@
+CREATE TABLE IF NOT EXISTS `refresh_tokens` (
+    `userId` UUID PRIMARY KEY,
+    `tokenHash` TEXT NOT NULL,
+    `expiresAt` TIMESTAMP NOT NULL,
+
+    CONSTRAINT `fk_refreshTokens_userId` FOREIGN KEY (`userId`) REFERENCES `users` (`id`) ON DELETE CASCADE
+)