- RealAuthManager: JWT signing/validation + bcrypt password hashing - MemUserStore: in-memory user store with default admin - Register endpoint: user creation with hashed password - Login endpoint: bcrypt verification + JWT generation - AuthManager interface extended with Login/Register methods