Add session-based authentication

Implement secure authentication using scs session manager with SQLite
backing store and bcrypt password hashing.

- Add users and sessions tables (migration 004)
- Create internal/auth package with Service, Middleware, and Handlers
- Protect all routes except /login, /logout, /static/*
- Add login page template and logout button to dashboard
- Default credentials: admin/changeme (configurable via env vars)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/internal/store/sqlite.go b/internal/store/sqlite.go
index dac3321..7961f35 100644
--- a/internal/store/sqlite.go
+++ b/internal/store/sqlite.go
@@ -59,6 +59,11 @@ func (s *Store) Close() error {
 	return s.db.Close()
 }
 
+// DB returns the underlying database connection
+func (s *Store) DB() *sql.DB {
+	return s.db
+}
+
 // runMigrations executes all migration files in order
 func (s *Store) runMigrations() error {
 	// Get migration files