feat: add cookie-based session authentication system

- Add admin user management with Argon2 password hashing
- Implement session management with ULID-based tokens and 7-day expiry
- Add authentication middleware for protected routes and API endpoints
- Forward validated session to SvelteKit via trusted X-Session-User header
- Refactor admin panel to use server-side authentication checks

Cargo.toml

@@ -5,9 +5,11 @@ edition = "2024"
 default-run = "api"
 
 [dependencies]
+argon2 = "0.5"
 aws-config = "1.8.12"
 aws-sdk-s3 = "1.119.0"
 axum = "0.8.8"
+axum-extra = { version = "0.12", features = ["cookie"] }
 clap = { version = "4.5.54", features = ["derive", "env"] }
 dashmap = "6.1.0"
 dotenvy = "0.15"
@@ -20,7 +22,7 @@ reqwest = { version = "0.13.1", default-features = false, features = ["rustls",
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.148"
 sqlx = { version = "0.8", features = ["runtime-tokio", "tls-rustls", "postgres", "uuid", "time", "migrate"] }
-time = { version = "0.3.44", features = ["formatting", "macros"] }
+time = { version = "0.3.44", features = ["formatting", "macros", "serde"] }
 tokio = { version = "1.49.0", features = ["full"] }
 tokio-util = { version = "0.7.18", features = ["io"] }
 tower = "0.5"
@@ -28,4 +30,5 @@ tower-http = { version = "0.6.8", features = ["trace", "cors", "limit"] }
 tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.22", features = ["env-filter", "json"] }
 ulid = { version = "1", features = ["serde"] }
+urlencoding = "2.1"
 uuid = { version = "1", features = ["serde", "v4"] }