feat(auth): интегрировать SSO auth-portal

JWT на backend, handoff/callback на UI, RBAC mm:*, AUTH_* в compose.

Co-authored-by: Cursor <[email protected]>

deploy/env.cdn-mm.example

@@ -29,7 +29,7 @@ CLOUDFLARE_API_TOKEN=
 LOG_LEVEL=info
 NODE_ENV=production
 
-# Portal SSO (prod default AUTH_REQUIRED=true)
+# Portal SSO — used by CDN Manager and MikrotikManager backend
 AUTH_REQUIRED=true
 # Same HS256 secret as auth-portal JWT_SECRET (required)
 AUTH_JWT_SECRET=
@@ -37,10 +37,10 @@ AUTH_JWT_SECRET=
 JWT_SECRET=
 AUTH_ISSUER=https://auth.shnt.top
 AUTH_PORTAL_URL=https://auth.shnt.top
-# Shared with auth-portal AUDIT_INGEST_SECRET (optional)
+# Shared with auth-portal AUDIT_INGEST_SECRET (optional, CDN Manager)
 AUTH_AUDIT_INGEST_SECRET=
 
-# Legacy local admin — only when AUTH_REQUIRED=false
+# Legacy local admin (CDN) — only when AUTH_REQUIRED=false
 ADMIN_USERNAME=admin
 ADMIN_PASSWORD_HASH=