feat(02-02): auth infrastructure -- route groups, middleware, session, auth-actions, auth store

- Create (auth) route group with standalone layout (no sidebar/header, D-04)
- Create (portal) route group wrapping children with AppShell
- Move dashboard page into (portal) route group
- Add Next.js middleware for JWT-based route protection using jose
- Create session.ts with verifySession/getSessionFromCookies helpers
- Create auth-actions.ts server actions: login, logout, fetchCurrentUser
- Create Zustand auth-store for client-side user state
- Install jose and zod dependencies

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/app/(portal)/layout.tsx

@@ -0,0 +1,13 @@
+import { AppShell } from '@/components/layout/app-shell';
+
+/**
+ * Portal layout - wraps all authenticated pages with AppShell (header + sidebar).
+ * All routes under (portal)/ get the full portal chrome.
+ */
+export default function PortalLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  return <AppShell>{children}</AppShell>;
+}