feat(auth): add user authentication with roles, HMAC-signed cookies, and login/register UI

- Add `users` PocketBase collection (username, password_hash, role, created)
- Implement HMAC-SHA256 signed cookie auth in hooks.server.ts; token payload is userId:username:role
- Add User type, getUserByUsername, createUser (scrypt), loginUser (timing-safe) to pocketbase.ts
- Add login/register page with tabbed form UI and server actions
- Add logout route that clears the auth cookie
- Add layout.server.ts auth guard: redirect unauthenticated users to /login
- Extend App.Locals and App.PageData with role field
- Add AUTH_SECRET, POCKETBASE_ADMIN_EMAIL/PASSWORD to .env.example
- Install @types/node for Node crypto/scrypt types

scraper/internal/storage/pocketbase.go

@@ -9,6 +9,7 @@
 //	ranking_html — page(number,unique), html(text), updated(date)
 //	progress     — session_id(text), slug(text), chapter(number), updated(date)
 //	audio_cache  — cache_key(text,unique), filename(text), updated(date)
+//	users        — username(text,unique), password_hash(text), role(text), created(date)
 package storage
 
 import (
@@ -312,6 +313,16 @@ func (s *PocketBaseStore) EnsureCollections(ctx context.Context) error {
 				{"name": "updated", "type": "date"},
 			},
 		},
+		{
+			"name": "users",
+			"type": "base",
+			"schema": []map[string]interface{}{
+				{"name": "username", "type": "text", "required": true, "options": map[string]interface{}{"min": 3, "max": 32}},
+				{"name": "password_hash", "type": "text", "required": true},
+				{"name": "role", "type": "text"},
+				{"name": "created", "type": "date"},
+			},
+		},
 	}
 	for _, col := range collections {
 		resp, err := s.pb.do(ctx, http.MethodPost, "/api/collections", col)