feat(02-02): auth infrastructure -- route groups, middleware, session, auth-actions, auth store

- Create (auth) route group with standalone layout (no sidebar/header, D-04)
- Create (portal) route group wrapping children with AppShell
- Move dashboard page into (portal) route group
- Add Next.js middleware for JWT-based route protection using jose
- Create session.ts with verifySession/getSessionFromCookies helpers
- Create auth-actions.ts server actions: login, logout, fetchCurrentUser
- Create Zustand auth-store for client-side user state
- Install jose and zod dependencies

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/lib/stores/auth-store.ts

@@ -0,0 +1,26 @@
+import { create } from 'zustand';
+
+export interface AuthUser {
+  id: string;
+  username: string;
+  displayName: string | null;
+  role: 'SUPER_ADMIN' | 'ADMIN' | 'USER';
+  tenantId: string;
+}
+
+interface AuthState {
+  user: AuthUser | null;
+  setUser: (user: AuthUser) => void;
+  clearUser: () => void;
+}
+
+/**
+ * Zustand store for client-side auth state.
+ * No persist middleware -- user state comes from API, not localStorage.
+ * Populated on portal load via fetchCurrentUser().
+ */
+export const useAuthStore = create<AuthState>()((set) => ({
+  user: null,
+  setUser: (user) => set({ user }),
+  clearUser: () => set({ user: null }),
+}));