Cookie-based auth/authz with CSRF; remove auth bypass

Replace the dev-only token shim with real authentication.

Backend:
- @fastify/cookie; JWT carried in an HttpOnly + SameSite=Strict cookie
  (parking_token), read from the cookie not the Authorization header.
- Double-submit CSRF: readable parking_csrf cookie + X-CSRF-Token header, both
  cross-checked against a csrf claim baked into the JWT; enforced on mutations.
- Routes: POST /api/auth/login (bcrypt, constant-time-ish), POST logout,
  GET me. requireRole now verifies the cookie + CSRF + role.
- seed-admin script (pnpm --filter @parking/server seed-admin) for the first
  admin; no bootstrap endpoint.
- Removed SETUP_AUTH_BYPASS and catalog.authBypass entirely; setup endpoints
  use the cookie admin guard like everything else.

Frontend:
- apiFetch wrapper: credentials:'include' + X-CSRF-Token on mutations.
- Login form; App gates on /api/auth/me and only shows setup to admins; logout.
- Wizard token field removed (auth is the session cookie).

Deploy:
- deploy/nginx.conf: prod reverse proxy, SPA + /api same-origin, TLS, so the
  Secure cookies work. Dev stays same-origin via the Vite proxy.

Verified (curl + browser): wrong pass -> 401; login sets cookies; me -> admin;
assign without CSRF -> 403, with -> 201; no cookie -> 401; session persists
across reload. wiki/local-jwt-auth updated.

wiki/log.md

@@ -72,3 +72,14 @@ is impossible as wired. UHPPOTE can't do it on that input; ZKTeco *might* via a
 programmable aux input + PULL SDK but that's unverified and needs a new driver.
 Recorded in [[access-controller-button-flow]] + [[zkteco-controller]]. Entry-lane
 hardware decision paused to focus on the business side.
+
+## [2026-06-15] feature | Cookie-based auth/authz (login, CSRF)
+Built real authentication: bcrypt login → JWT in an HttpOnly+SameSite=Strict
+cookie, readable CSRF cookie + X-CSRF-Token header (double-submit) on mutations,
+role-guarded routes. Routes: /api/auth/{login,logout,me}. First admin seeded via
+`pnpm --filter @parking/server seed-admin`. Removed the SETUP_AUTH_BYPASS shim
+and the wizard token field; the SPA gates on /api/auth/me and only shows setup to
+admins. Same-origin via the Vite dev proxy and a new prod nginx config
+(deploy/nginx.conf). Verified end to end (curl + browser): wrong pass→401,
+login→cookies set, me→admin, assign without CSRF→403 / with→201, no cookie→401,
+session persists across reload. Updated [[local-jwt-auth]].