feat(app): add plugin system with auth plugin and static assets

Add new application structure:
- app/main.py - application entry point
- app/plugins/ - plugin system with auth plugin:
  - api/ - REST API endpoints and schemas
  - authorization/ - auth policies, providers, hooks
  - domain/ - business logic (service, models, jwt, password)
  - injection/ - route injection and guards
  - ops/ - operational utilities
  - runtime/ - runtime configuration
  - security/ - middleware, CSRF, dependencies
  - storage/ - user repositories and models
- app/static/ - static assets (scalar.js for API docs)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/plugins/auth/security/__init__.py

@@ -0,0 +1,47 @@
+"""Security layer for the auth plugin."""
+
+from app.plugins.auth.security.actor_context import (
+    bind_request_actor_context,
+    bind_user_actor_context,
+    resolve_request_user_id,
+)
+from app.plugins.auth.security.csrf import (
+    CSRF_COOKIE_NAME,
+    CSRF_HEADER_NAME,
+    CSRFMiddleware,
+    get_csrf_token,
+    is_secure_request,
+)
+from app.plugins.auth.security.dependencies import (
+    CurrentAuthService,
+    CurrentUserRepository,
+    get_auth_service,
+    get_current_user_from_request,
+    get_current_user_id,
+    get_optional_user_from_request,
+    get_user_repository,
+)
+from app.plugins.auth.security.langgraph import add_owner_filter, auth, authenticate
+from app.plugins.auth.security.middleware import AuthMiddleware
+
+__all__ = [
+    "CSRF_COOKIE_NAME",
+    "CSRF_HEADER_NAME",
+    "CSRFMiddleware",
+    "AuthMiddleware",
+    "CurrentAuthService",
+    "CurrentUserRepository",
+    "add_owner_filter",
+    "auth",
+    "authenticate",
+    "bind_request_actor_context",
+    "bind_user_actor_context",
+    "get_auth_service",
+    "get_csrf_token",
+    "get_current_user_from_request",
+    "get_current_user_id",
+    "get_optional_user_from_request",
+    "get_user_repository",
+    "is_secure_request",
+    "resolve_request_user_id",
+]