feat: Phase 1 - multi-user auth foundation

- New auth.py module: users table, invite_codes table, JWT auth,
  password hashing (bcrypt), auth dependencies for FastAPI
- KITHARA_MODE=single|multi in .env (default: single)
- Single mode: no auth required, no login, user_id='default'
- Multi mode: full JWT auth, login/register endpoints, admin bootstrap
- Health endpoint now reports mode: {status, version, mode}
- Auth endpoints: POST /api/auth/login, /register, GET /me
- Admin endpoints: GET /admin/users, POST /admin/users,
  POST /admin/invites, GET /admin/invites,
  DELETE /admin/users/:id, PUT /admin/users/:id/role
- BYOK: PUT /api/auth/api-key for per-user Lyria keys
- DB migrations: user_id, shared, remixed_from columns on clips
- DB indexes for user-based and shared-content queries
- requirements.txt: added PyJWT and passlib[bcrypt]
- .env.example: documented all new config options

backend/.env.example

@@ -2,7 +2,17 @@ LYRIA_API_KEY=your-api-key-here
 LYRIA_DEFAULT_MODEL=lyria-3-clip-preview
 TZ=America/New_York
 
-# Optional: Default ID3 tag values applied on download when track metadata is empty
+# Default ID3 tag values applied on download when track metadata is empty
 # DEFAULT_ID3_ARTIST=Kithara Studio
 # DEFAULT_ID3_ALBUM=Kithara Studio Collection
-# DEFAULT_ID3_GENRE=Hardcore Techno
+# DEFAULT_ID3_GENRE=Hardcore Techno
+
+# Auth mode: single (no login) or multi (full auth)
+KITHARA_MODE=single
+
+# Bootstrap admin (only used in multi mode, first startup)
+# KITHARA_ADMIN_USER=admin
+# KITHARA_ADMIN_PASS=changeme
+
+# JWT secret (auto-generated if not set, persists in DB)
+# KITHARA_JWT_SECRET=your-secret-here