feat(backend): add JWT authentication, RBAC and consent/audit services

Add signup/signin with backend-issued JWT (Argon2 passwords in SurrealDB), role-based authorization policies, per-user data access levels, consent register and read audit log. Protect user endpoints and record sensitive reads.

backend/Application/Security/SecurityConstants.cs

@@ -0,0 +1,47 @@
+namespace TarninaHub.Application.Security;
+
+public static class RoleNames
+{
+    public const string User = "user";
+    public const string Jst = "jst";
+    public const string Operator = "operator";
+    public const string Manager = "manager";
+    public const string Admin = "admin";
+
+    public static readonly IReadOnlyList<string> All =
+        [User, Jst, Operator, Manager, Admin];
+
+    public static bool IsValid(string role) => All.Contains(role);
+}
+
+public static class Policies
+{
+    /// <summary>operator, manager, admin — ROPS/expert staff.</summary>
+    public const string Staff = "Staff";
+
+    /// <summary>operator, admin.</summary>
+    public const string OperatorOrAdmin = "OperatorOrAdmin";
+
+    /// <summary>manager, operator, admin.</summary>
+    public const string ManagerOrAbove = "ManagerOrAbove";
+
+    /// <summary>admin only.</summary>
+    public const string AdminOnly = "AdminOnly";
+
+    /// <summary>jst and above (jst, operator, manager, admin).</summary>
+    public const string JstOrAbove = "JstOrAbove";
+}
+
+public static class ConsentScopes
+{
+    /// <summary>Access granted by the data subject's consent.</summary>
+    public const string ByConsent = "by-consent";
+
+    /// <summary>Time-limited access (uses consent.expires_at).</summary>
+    public const string Temporary = "temporary";
+
+    /// <summary>Fully anonymized data (no personal identifiers).</summary>
+    public const string Anonymized = "anonymized";
+
+    public static readonly IReadOnlyList<string> All = [ByConsent, Temporary, Anonymized];
+}