feat(auth): replace stub auth with real JWT + bcrypt

- RealAuthManager: JWT signing/validation + bcrypt password hashing
- MemUserStore: in-memory user store with default admin
- Register endpoint: user creation with hashed password
- Login endpoint: bcrypt verification + JWT generation
- AuthManager interface extended with Login/Register methods

backend/cmd/cyrene/main.go

@@ -176,7 +176,8 @@ func main() {
 	log.Printf("[orchestrator] pipeline ready")
 
 	// === 12. Gateway ===
-	authMgr := api.NewStubAuthManager()
+	userStore := api.NewMemUserStore(cfg.AdminPassword)
+	authMgr := api.NewRealAuthManager(cfg.JWTSecret, cfg.JWTExpiryHours, userStore)
 
 	// Build dependencies for gateway handlers
 	gwDeps := api.Dependencies{