feat(backend): add JWT authentication, RBAC and consent/audit services

Add signup/signin with backend-issued JWT (Argon2 passwords in SurrealDB), role-based authorization policies, per-user data access levels, consent register and read audit log. Protect user endpoints and record sensitive reads.

backend/Infrastructure/Persistence/SurrealRows.cs

@@ -0,0 +1,36 @@
+using Dahomey.Cbor.Attributes;
+
+namespace TarninaHub.Infrastructure.Persistence;
+
+internal sealed class UserRow
+{
+    [CborProperty("id")] public string Id { get; set; } = string.Empty;
+
+    [CborProperty("phone")] public string Phone { get; set; } = string.Empty;
+
+    [CborProperty("email")] public string? Email { get; set; }
+
+    [CborProperty("role")] public string Role { get; set; } = string.Empty;
+
+    [CborProperty("organization")] public string? Organization { get; set; }
+}
+
+internal sealed class PasswordCheckRow
+{
+    [CborProperty("password_ok")] public bool PasswordOk { get; set; }
+}
+
+internal sealed class ConsentRow
+{
+    [CborProperty("id")] public string Id { get; set; } = string.Empty;
+
+    [CborProperty("user")] public string User { get; set; } = string.Empty;
+
+    [CborProperty("scope")] public string Scope { get; set; } = string.Empty;
+
+    [CborProperty("granted_at")] public DateTimeOffset GrantedAt { get; set; }
+
+    [CborProperty("expires_at")] public DateTimeOffset? ExpiresAt { get; set; }
+
+    [CborProperty("revoked_at")] public DateTimeOffset? RevokedAt { get; set; }
+}