v0.2.55

feat: replace API key auth with email/password login system

- Add admin account creation (email + bcrypt password) on first setup
- Add JWT-based session tokens (HMAC-SHA256, 30-day expiry)
- Replace API key middleware with JWT Bearer token middleware
- Add POST /api/login endpoint for returning users
- Update frontend: setup modal now collects email/password
- Add login modal shown when admin exists but user is not authenticated

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>