Player accounts (auth slice 1): register/login, JWT issuance, isolation

GUPI-issued local auth (path A): osint.users (handle + scrypt password_hash +
display_name + avatar_url; external_id reserved for a later glitch.university
key-exchange). POST /api/auth/register|login set the auth_token cookie via a
new signPlayerToken (sub=user id, role=player); /logout and /me added. Because
playthroughs already bind to resolveUserId, two players each "Begin" and stay
fully isolated. Verification stays issuer-agnostic for the external swap later.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

migrations/036_users.sql

@@ -0,0 +1,12 @@
+-- Locally-issued player accounts. GUPI mints the JWT for now; external_id is
+-- reserved so a glitch.university key-exchange can later link/migrate an account
+-- without changing how playthroughs bind (they key off the JWT sub = users.id).
+CREATE TABLE osint.users (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  handle TEXT NOT NULL UNIQUE CHECK (handle ~ '^[a-z0-9_.-]{3,32}$'),
+  password_hash TEXT NOT NULL,
+  display_name TEXT NOT NULL,
+  avatar_url TEXT,
+  external_id TEXT UNIQUE,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);