Cookie-based auth/authz with CSRF; remove auth bypass

Replace the dev-only token shim with real authentication.

Backend:
- @fastify/cookie; JWT carried in an HttpOnly + SameSite=Strict cookie
  (parking_token), read from the cookie not the Authorization header.
- Double-submit CSRF: readable parking_csrf cookie + X-CSRF-Token header, both
  cross-checked against a csrf claim baked into the JWT; enforced on mutations.
- Routes: POST /api/auth/login (bcrypt, constant-time-ish), POST logout,
  GET me. requireRole now verifies the cookie + CSRF + role.
- seed-admin script (pnpm --filter @parking/server seed-admin) for the first
  admin; no bootstrap endpoint.
- Removed SETUP_AUTH_BYPASS and catalog.authBypass entirely; setup endpoints
  use the cookie admin guard like everything else.

Frontend:
- apiFetch wrapper: credentials:'include' + X-CSRF-Token on mutations.
- Login form; App gates on /api/auth/me and only shows setup to admins; logout.
- Wizard token field removed (auth is the session cookie).

Deploy:
- deploy/nginx.conf: prod reverse proxy, SPA + /api same-origin, TLS, so the
  Secure cookies work. Dev stays same-origin via the Vite proxy.

Verified (curl + browser): wrong pass -> 401; login sets cookies; me -> admin;
assign without CSRF -> 403, with -> 201; no cookie -> 401; session persists
across reload. wiki/local-jwt-auth updated.

apps/server/src/server.ts

@@ -1,7 +1,9 @@
+import cookie from "@fastify/cookie";
 import jwt from "@fastify/jwt";
 import Fastify, { type FastifyInstance } from "fastify";
 import { createDb, type Db } from "@parking/db";
-import { requireJwtSecret } from "./auth.js";
+import { TOKEN_COOKIE, requireJwtSecret } from "./auth.js";
+import { authRoutes } from "./routes/auth.js";
 import { setupRoutes } from "./routes/setup.js";
 
 // The backend is Fastify (Node). Hardware drivers live as isolated Fastify
@@ -19,22 +21,29 @@ export async function buildServer(opts: BuildOptions = {}): Promise<FastifyInsta
 
   const db = opts.db ?? createDb();
 
+  await app.register(cookie);
+
   // Local JWT signing with a local secret — no external identity provider.
   // Fail fast rather than fall back to a known default: a booth machine started
   // without a real secret would sign tokens anyone could forge (incl. an admin
   // token), defeating the whole local-auth/anti-fraud model. No insecure default.
+  // The token is carried in an HttpOnly cookie (not the Authorization header).
   await app.register(jwt, {
     secret: requireJwtSecret(),
     sign: { expiresIn: "8h" }, // bound to a shift; minted tokens must expire
+    cookie: { cookieName: TOKEN_COOKIE, signed: false },
   });
 
   app.get("/health", async () => ({ status: "ok" }));
 
+  // Local username/password login → JWT in an HttpOnly cookie + CSRF cookie.
+  await authRoutes(app, db);
+
   // Device-agnostic setup: the admin selects devices per lane from the driver
   // catalog at first-run. See wiki/concepts/first-run-setup.md.
   await setupRoutes(app, db);
 
-  // TODO: device-driver runtime plugins, append-only event-log routes, login.
+  // TODO: device-driver runtime plugins, append-only event-log routes.
 
   return app;
 }