Add REST API endpoints with session-based auth

[karngyan]

Summary

• Add complete REST API layer with auth (signup, login, logout, me), workspaces (CRUD), repositories (CRUD + reindex), git tokens (CRUD), and semantic search endpoints
• Implement cookie-based session authentication with WrapAuth middleware in web.Context, backed by a users/sessions domain layer with bcrypt password hashing
• Add database migration and sqlc queries for users and sessions tables
• Include comprehensive test coverage for all endpoints using approval-based JSON snapshot testing

Test Plan

• Verify make test passes for all new endpoint tests
• Test auth flow: signup -> login -> me -> logout
• Test authenticated CRUD operations on workspaces, repositories, and git tokens
• Verify unauthenticated requests return 401
• Test semantic search endpoint with authenticated user