feat: simplify auth flow - replace JWT with session cookies

Replace complex JWT + refresh token authentication with simple
session-based auth using signed cookies.

**Removed:**
- JWT token service (jwt_service.py)
- Refresh token store (refresh_store.py)
- Refresh token model and database table
- JWKS fetching and OIDC token verification
- python-jose dependency

**Added:**
- Session service (session.py) with HMAC-SHA256 signed cookies
- Auth dependencies module for shared auth logic
- Session-based auth endpoints

**Updated:**
- All API endpoints to use session-based auth
- Config: removed JWT settings, added SESSION_SECRET/SESSION_TTL_HOURS
- Tests: rewritten for session-based flow
- Frontend: no changes needed (already uses cookies)

Quality gates: ruff ✓, mypy ✓, typecheck ✓, lint ✓

openspec/changes/simplify-authentik-auth/proposal.md

@@ -0,0 +1,49 @@
+# Simplify Authentik Auth Flow
+
+## Problem
+
+The current authentication implementation is overly complex for our needs:
+
+- **Multiple layers**: OIDC token exchange, refresh token rotation, complex cookie management
+- **Difficult to debug**: Many moving parts make deployment issues hard to diagnose
+- **Over-engineered**: We don't need the full OIDC flow complexity for our use case
+- **Maintenance burden**: The sophisticated approach requires deep understanding of OAuth2/OIDC internals
+
+## Solution
+
+Replace the current complex auth flow with a simplified approach:
+
+1. **Authentik OAuth**: Keep OAuth2 authentication via Authentik
+2. **Session-based**: Use simple session cookies instead of JWT + refresh tokens
+3. **Authentik as source of truth**: User profiles synced from Authentik on login
+4. **Simpler implementation**: Reduce auth-related code by ~70%
+
+## Benefits
+
+- **Easier to deploy**: Fewer configuration variables and moving parts
+- **Easier to debug**: Clear flow: Login → Authentik → Session Cookie
+- **Less code**: Remove JWT service, refresh token store, complex OIDC logic
+- **Future-proof**: Still supports teams/groups via Authentik's user info endpoint
+- **Better UX**: No token refresh issues, simpler logout
+
+## Scope
+
+### What stays:
+- OAuth2 authentication via Authentik
+- User model in database (synced from Authentik)
+- Protected routes requiring authentication
+- Frontend auth state management
+
+### What goes:
+- JWT access tokens
+- Refresh token rotation
+- Complex OIDC token verification
+- Multiple cookie types (access_token, refresh_token)
+- Token expiry/refresh logic
+- JWKS fetching and validation
+
+### What's new:
+- Simple session cookie (httpOnly, secure, SameSite)
+- Authentik user info endpoint integration
+- Simplified auth middleware
+- Cleaner logout (just delete session)