feat(app): add plugin system with auth plugin and static assets

Add new application structure:
- app/main.py - application entry point
- app/plugins/ - plugin system with auth plugin:
  - api/ - REST API endpoints and schemas
  - authorization/ - auth policies, providers, hooks
  - domain/ - business logic (service, models, jwt, password)
  - injection/ - route injection and guards
  - ops/ - operational utilities
  - runtime/ - runtime configuration
  - security/ - middleware, CSRF, dependencies
  - storage/ - user repositories and models
- app/static/ - static assets (scalar.js for API docs)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/plugins/auth/README.md

@@ -0,0 +1,21 @@
+# Auth Plugin
+
+This package is the future Level 2 auth plugin boundary for DeerFlow.
+
+Scope:
+
+- Auth domain logic: config, errors, models, JWT, password hashing, service
+- Auth adapters: HTTP router, FastAPI dependencies, middleware, LangGraph adapter
+- Auth storage: user/account models and repositories
+
+Non-scope:
+
+- Shared app/container bootstrap
+- Shared persistence engine/session lifecycle
+- Generic plugin discovery/registration framework
+
+Target architecture:
+
+- The plugin owns its storage definitions and business logic
+- The plugin reuses the application's shared persistence infrastructure
+- The gateway only assembles the plugin instead of owning auth logic directly