feat(auth): implement portal SSO and local admin authentication

Added support for portal SSO with JWT authentication and local admin login. Updated environment configuration to include AUTH_REQUIRED, AUTH_JWT_SECRET, AUTH_ISSUER, and AUTH_PORTAL_URL. Enhanced the auth plugin to handle JWT verification based on the new configuration. Introduced new routes for authentication and updated the API client to manage token handling and redirects. Improved user experience by integrating authentication checks across various routes and components.

.env.example

@@ -4,15 +4,24 @@ CLOUDFLARE_API_TOKEN=
 # Database
 DATABASE_URL=sqlite:data/app.db
 
-# Auth
-JWT_SECRET=dev-secret-change-me
+# Auth — portal SSO (prod) или локальный admin (dev)
+# AUTH_REQUIRED=true → JWT от auth-portal, apps включает cfdm
+AUTH_REQUIRED=false
+AUTH_JWT_SECRET=dev-secret-change-me
+# alias: JWT_SECRET=
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=http://localhost:5175
 JWT_TTL_HOURS=24
+
+# Legacy local login (только при AUTH_REQUIRED=false)
 ADMIN_USERNAME=admin
 # Leave empty for dev default password "admin"
 ADMIN_PASSWORD_HASH=
 
-# Frontend (Vite)
-# Публичные URL приложений и integration token настраиваются в UI: Настройки → Интеграции
+# Frontend (Vite) — apps/web/.env.local
+# VITE_AUTH_ENABLED=true
+# VITE_AUTH_PORTAL_URL=http://localhost:5175
+# Публичные URL приложений и integration token: Настройки → Интеграции
 
 # ReUI PRO (apps/web/components.json → @reui Authorization)
 # Ключ: https://reui.io/docs/license-setup — класть в .env.local (gitignored)