feat(backend): add JWT authentication, RBAC and consent/audit services

Add signup/signin with backend-issued JWT (Argon2 passwords in SurrealDB), role-based authorization policies, per-user data access levels, consent register and read audit log. Protect user endpoints and record sensitive reads.

backend/Program.cs

@@ -1,17 +1,71 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Text;
 using Asp.Versioning;
 using Asp.Versioning.ApiExplorer;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
 using Swashbuckle.AspNetCore.SwaggerGen;
 using TarninaHub.Application.Abstractions;
+using TarninaHub.Application.Security;
 using TarninaHub.Configuration;
 using TarninaHub.Errors;
 using TarninaHub.Infrastructure;
+using TarninaHub.Infrastructure.Auth;
 
 var builder = WebApplication.CreateBuilder(args);
 
 // Layered infrastructure: SurrealDB client, settings and persistence services.
 builder.Services.AddInfrastructure(builder.Configuration);
 
+// Authentication (JWT bearer) and role-based authorization policies.
+var authSettings = builder.Configuration.GetSection("Auth").Get<AuthSettings>() ?? new AuthSettings();
+
+if (!authSettings.HasUsableSigningKey && !builder.Environment.IsDevelopment())
+{
+    throw new InvalidOperationException(
+        "Auth signing key is missing or too short. Configure 'Auth:SigningKey' " +
+        "(env 'Auth__SigningKey') with at least 32 characters.");
+}
+
+var signingKey = authSettings.HasUsableSigningKey
+    ? authSettings.SigningKey
+    : "development-only-signing-key-please-override-in-production";
+
+builder.Services
+    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+    .AddJwtBearer(options =>
+    {
+        options.MapInboundClaims = false;
+        options.TokenValidationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidIssuer = authSettings.Issuer,
+            ValidateAudience = true,
+            ValidAudience = authSettings.Audience,
+            ValidateIssuerSigningKey = true,
+            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(signingKey)),
+            ValidateLifetime = true,
+            ClockSkew = TimeSpan.FromSeconds(30),
+            NameClaimType = JwtRegisteredClaimNames.Sub,
+            RoleClaimType = "role",
+        };
+    });
+
+builder.Services.AddAuthorization(options =>
+{
+    options.AddPolicy(Policies.Staff,
+        policy => policy.RequireRole(RoleNames.Operator, RoleNames.Manager, RoleNames.Admin));
+    options.AddPolicy(Policies.OperatorOrAdmin,
+        policy => policy.RequireRole(RoleNames.Operator, RoleNames.Admin));
+    options.AddPolicy(Policies.ManagerOrAbove,
+        policy => policy.RequireRole(RoleNames.Manager, RoleNames.Operator, RoleNames.Admin));
+    options.AddPolicy(Policies.AdminOnly,
+        policy => policy.RequireRole(RoleNames.Admin));
+    options.AddPolicy(Policies.JstOrAbove,
+        policy => policy.RequireRole(RoleNames.Jst, RoleNames.Operator, RoleNames.Manager, RoleNames.Admin));
+});
+
 builder.Services.AddControllers();
 
 // Uniform error responses (RFC 7807) and a global exception handler.
@@ -76,6 +130,9 @@ if (!app.Environment.IsDevelopment())
 app.UseDefaultFiles();
 app.UseStaticFiles();
 
+app.UseAuthentication();
+app.UseAuthorization();
+
 app.MapControllers();
 
 app.MapFallbackToFile("index.html");