feat: simplify auth flow - replace JWT with session cookies

Replace complex JWT + refresh token authentication with simple
session-based auth using signed cookies.

**Removed:**
- JWT token service (jwt_service.py)
- Refresh token store (refresh_store.py)
- Refresh token model and database table
- JWKS fetching and OIDC token verification
- python-jose dependency

**Added:**
- Session service (session.py) with HMAC-SHA256 signed cookies
- Auth dependencies module for shared auth logic
- Session-based auth endpoints

**Updated:**
- All API endpoints to use session-based auth
- Config: removed JWT settings, added SESSION_SECRET/SESSION_TTL_HOURS
- Tests: rewritten for session-based flow
- Frontend: no changes needed (already uses cookies)

Quality gates: ruff ✓, mypy ✓, typecheck ✓, lint ✓

apps/api/src/auth/__init__.py

@@ -1,12 +1,10 @@
 from src.auth.cookies import build_cookie_options
-from src.auth.jwt_service import decode_access_token, mint_access_token
 from src.auth.oidc import build_login_redirect_url
-from src.auth.refresh_store import hash_refresh_token
+from src.auth.session import create_session_cookie, decode_session_cookie
 
 __all__ = [
     "build_cookie_options",
     "build_login_redirect_url",
-    "decode_access_token",
-    "hash_refresh_token",
-    "mint_access_token",
+    "create_session_cookie",
+    "decode_session_cookie",
 ]