feat(auth): replace stub auth with real JWT + bcrypt

- RealAuthManager: JWT signing/validation + bcrypt password hashing
- MemUserStore: in-memory user store with default admin
- Register endpoint: user creation with hashed password
- Login endpoint: bcrypt verification + JWT generation
- AuthManager interface extended with Login/Register methods

backend/services/gateway/api/auth_stub.go

@@ -54,3 +54,14 @@ func (m *StubAuthManager) Login(username, password string) (string, error) {
 	m.tokens[token] = TokenInfo{UserID: username, Username: username, Role: user.Role}
 	return token, nil
 }
+
+// Register creates a new user and returns a stub token.
+func (m *StubAuthManager) Register(username, password string) (string, error) {
+	if _, exists := m.users[username]; exists {
+		return "", http.ErrNoCookie
+	}
+	m.users[username] = UserInfo{Username: username, Password: password, Role: "user"}
+	token := "stub-token-" + username
+	m.tokens[token] = TokenInfo{UserID: username, Username: username, Role: "user"}
+	return token, nil
+}