feat(backend): add JWT authentication, RBAC and consent/audit services

Add signup/signin with backend-issued JWT (Argon2 passwords in SurrealDB), role-based authorization policies, per-user data access levels, consent register and read audit log. Protect user endpoints and record sensitive reads.

backend/Application/Security/ClaimsPrincipalExtensions.cs

@@ -0,0 +1,12 @@
+using System.Security.Claims;
+
+namespace TarninaHub.Application.Security;
+
+public static class ClaimsPrincipalExtensions
+{
+    public static string? GetUserId(this ClaimsPrincipal principal) =>
+        principal.FindFirst("sub")?.Value;
+
+    public static string? GetRole(this ClaimsPrincipal principal) =>
+        principal.FindFirst("role")?.Value;
+}