feat: add authentication, audit log, HTTP API and base web UI

Phase 1 foundation. Local auth per ADR-0006: Argon2id passwords, opaque
hashed session tokens with idle/absolute expiry, CSRF token plus Origin
check on cookie sessions, per-IP token bucket and per-account exponential
lockout, three roles enforced by middleware, personal API tokens for
noemactl. Audit log writer used by every admin mutation.

API: request ids, panic recovery, strict CSP and security headers, body
limits, single JSON error envelope, health/ready/status, users, sessions,
tokens, audit, token-protected /metrics.

UI: embedded html/template pages (login, first-run setup, dashboard,
system, users, account, audit, interpretation boundary), light/dark
theme, dependency-free app.js with CSRF-aware fetch and SSE helper.

Binaries: noemad with graceful shutdown, migrations at start, bootstrap
admin from environment, supervised background tasks; noemactl with
status, migrate, user create and meaningful exit codes.

internal/app/app.go

@@ -0,0 +1,29 @@
+// Package app holds the dependency bundle shared by the HTTP API, the web UI
+// and the CLI-facing services. It exists so that constructors take one typed
+// value instead of a growing parameter list, without resorting to globals.
+package app
+
+import (
+	"io/fs"
+	"log/slog"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/andydixon/noema/internal/audit"
+	"github.com/andydixon/noema/internal/auth"
+	"github.com/andydixon/noema/internal/config"
+	"github.com/andydixon/noema/internal/observability"
+)
+
+// Deps is everything a handler may need. Fields are added per phase.
+type Deps struct {
+	Config     config.Config
+	Log        *slog.Logger
+	DB         *pgxpool.Pool
+	Auth       *auth.Service
+	Audit      *audit.Logger
+	Metrics    *observability.Metrics
+	Migrations fs.FS
+	Started    time.Time
+}