feat: add manual account creation and password auth flow

[contractorr]

Problem

Account creation currently depends on Google or GitHub OAuth. That blocks users who do not want to use those providers or cannot use them in their environment.

Proposed Behavior

• Add a manual sign-up flow using email/username plus password
• Add a matching sign-in flow for manually created accounts
• Support password hashing, reset-ready account records, and validation/error handling
• Keep OAuth sign-in available alongside the manual flow
• Make onboarding and existing user data isolation work the same regardless of auth method

Scope

• Backend auth models, validation, password hashing, and session issuance
• Web auth UI for sign up / sign in / provider choice
• Migration path for existing auth tables and tests for manual auth

Acceptance Criteria

• A user can create an account without Google or GitHub
• A manually created account can sign in and access the same app flows as OAuth users
• Passwords are stored securely with modern hashing and validation rules
• Existing OAuth login continues to work unchanged