fix: auth quality issues — token cleanup, delete_cookie params, broad exception catch, dead import

feat: implement auth router (signup/login/refresh/logout) and FastAPI deps

fix: add JWT secret warning and missing security tests

feat: implement JWT access token and refresh token generation

feat: implement bcrypt password hashing

chore: add backend directory structure and stub files