feat: simplify auth flow - replace JWT with session cookies

Replace complex JWT + refresh token authentication with simple
session-based auth using signed cookies.

**Removed:**
- JWT token service (jwt_service.py)
- Refresh token store (refresh_store.py)
- Refresh token model and database table
- JWKS fetching and OIDC token verification
- python-jose dependency

**Added:**
- Session service (session.py) with HMAC-SHA256 signed cookies
- Auth dependencies module for shared auth logic
- Session-based auth endpoints

**Updated:**
- All API endpoints to use session-based auth
- Config: removed JWT settings, added SESSION_SECRET/SESSION_TTL_HOURS
- Tests: rewritten for session-based flow
- Frontend: no changes needed (already uses cookies)

Quality gates: ruff ✓, mypy ✓, typecheck ✓, lint ✓

apps/api/src/config.py

@@ -43,10 +43,9 @@ class Settings(BaseSettings):
     authentik_issuer: str | None = None
     authentik_audience: str = "headquarter-web"
 
-    jwt_secret: str = "change-me-jwt-secret"
-    jwt_algorithm: str = "HS256"
-    access_token_ttl_minutes: int = 15
-    refresh_token_ttl_days: int = 7
+    # Session configuration
+    session_secret: str = "change-me-session-secret"
+    session_ttl_hours: int = 24
 
     # Repository storage
     repo_base_path: str = "/data/repos"