feat(backend): add JWT authentication, RBAC and consent/audit services

Add signup/signin with backend-issued JWT (Argon2 passwords in SurrealDB), role-based authorization policies, per-user data access levels, consent register and read audit log. Protect user endpoints and record sensitive reads.

backend/Infrastructure/Persistence/SurrealRecordId.cs

@@ -0,0 +1,13 @@
+namespace TarninaHub.Infrastructure.Persistence;
+
+internal static class SurrealRecordId
+{
+    public static (string Table, string Id) Split(string recordId)
+    {
+        var separator = recordId.IndexOf(':', StringComparison.Ordinal);
+
+        return separator < 0
+            ? (recordId, recordId)
+            : (recordId[..separator], recordId[(separator + 1)..]);
+    }
+}