feat(backend): add JWT authentication, RBAC and consent/audit services

Add signup/signin with backend-issued JWT (Argon2 passwords in SurrealDB), role-based authorization policies, per-user data access levels, consent register and read audit log. Protect user endpoints and record sensitive reads.

backend/Application/Abstractions/IAuditLogService.cs

@@ -0,0 +1,11 @@
+namespace TarninaHub.Application.Abstractions;
+
+public interface IAuditLogService
+{
+    Task RecordAsync(
+        string? actorId,
+        string action,
+        string target,
+        IReadOnlyDictionary<string, object?> context,
+        CancellationToken cancellationToken);
+}

backend/Application/Abstractions/IConsentService.cs

@@ -0,0 +1,20 @@
+using TarninaHub.Application.Dtos;
+
+namespace TarninaHub.Application.Abstractions;
+
+public interface IConsentService
+{
+    Task<ConsentResponse> GrantAsync(
+        string userId,
+        GrantConsentRequest request,
+        CancellationToken cancellationToken);
+
+    Task<IReadOnlyList<ConsentResponse>> ListForUserAsync(
+        string userId,
+        CancellationToken cancellationToken);
+
+    Task<bool> RevokeAsync(
+        string consentId,
+        string userId,
+        CancellationToken cancellationToken);
+}

backend/Application/Abstractions/ITokenService.cs

@@ -0,0 +1,10 @@
+using TarninaHub.Application.Models;
+
+namespace TarninaHub.Application.Abstractions;
+
+public interface ITokenService
+{
+    TokenResult CreateToken(UserAccount user);
+}
+
+public sealed record TokenResult(string AccessToken, DateTimeOffset ExpiresAt);

backend/Application/Abstractions/IUserService.cs

@@ -0,0 +1,15 @@
+using TarninaHub.Application.Dtos;
+using TarninaHub.Application.Models;
+
+namespace TarninaHub.Application.Abstractions;
+
+public interface IUserService
+{
+    Task<UserAccount?> FindByPhoneAsync(string phone, CancellationToken cancellationToken);
+
+    Task<UserAccount?> GetByIdAsync(string userId, CancellationToken cancellationToken);
+
+    Task<UserAccount?> CreateAsync(RegisterRequest request, string role, CancellationToken cancellationToken);
+
+    Task<bool> VerifyCredentialsAsync(string phone, string password, CancellationToken cancellationToken);
+}