Add authentication, user management, and database migration features

- Implement OAuth 2.0 and PAT authentication methods
- Add user management, roles, and profile functionality
- Add database migrations and admin user scripts
- Update services for authentication and user settings
- Add protected routes and permission hooks
- Update documentation for authentication and database access

docs/AUTHENTICATION-IMPLEMENTATION-STATUS.md

@@ -0,0 +1,119 @@
+# Authentication System Implementation Status
+
+## ✅ Completed Features
+
+### Backend
+- ✅ Database schema with users, roles, permissions, sessions, user_settings, email_tokens tables
+- ✅ User service (CRUD, password hashing, email verification, password reset)
+- ✅ Role service (dynamic role and permission management)
+- ✅ Auth service (local auth + OAuth with database-backed sessions)
+- ✅ Email service (Nodemailer with SMTP)
+- ✅ Encryption service (AES-256-GCM for sensitive data)
+- ✅ User settings service (Jira PAT, AI features, API keys)
+- ✅ Authorization middleware (requireAuth, requireRole, requirePermission)
+- ✅ All API routes protected with authentication
+- ✅ Auth routes (login, logout, password reset, email verification, invitations)
+- ✅ User management routes (admin only)
+- ✅ Role management routes
+- ✅ User settings routes
+- ✅ Profile routes
+
+### Frontend
+- ✅ Auth store extended with roles, permissions, local auth support
+- ✅ Permission hooks (useHasPermission, useHasRole, usePermissions)
+- ✅ ProtectedRoute component
+- ✅ Login component (local login + OAuth choice)
+- ✅ ForgotPassword component
+- ✅ ResetPassword component
+- ✅ AcceptInvitation component
+- ✅ UserManagement component (admin)
+- ✅ RoleManagement component (admin)
+- ✅ UserSettings component
+- ✅ Profile component
+- ✅ UserMenu with logout and profile/settings links
+- ✅ Feature gating based on permissions
+
+## 🔧 Configuration Required
+
+### Environment Variables
+
+**Required for local authentication:**
+```env
+LOCAL_AUTH_ENABLED=true
+```
+
+**Required for email functionality:**
+```env
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=your-email@example.com
+SMTP_PASSWORD=your-password
+SMTP_FROM=noreply@example.com
+```
+
+**Required for encryption:**
+```env
+ENCRYPTION_KEY=your-32-byte-encryption-key-base64
+```
+
+**Optional - Initial admin user:**
+```env
+ADMIN_EMAIL=admin@example.com
+ADMIN_PASSWORD=SecurePassword123!
+ADMIN_USERNAME=admin
+ADMIN_DISPLAY_NAME=Administrator
+```
+
+**Password requirements:**
+```env
+PASSWORD_MIN_LENGTH=8
+PASSWORD_REQUIRE_UPPERCASE=true
+PASSWORD_REQUIRE_LOWERCASE=true
+PASSWORD_REQUIRE_NUMBER=true
+PASSWORD_REQUIRE_SPECIAL=false
+```
+
+**Session duration:**
+```env
+SESSION_DURATION_HOURS=24
+```
+
+## 📝 Notes
+
+### JIRA_AUTH Settings
+- `JIRA_PAT` can be removed from global env - users configure their own PAT in settings
+- `JIRA_OAUTH_CLIENT_ID` and `JIRA_OAUTH_CLIENT_SECRET` are still needed for OAuth flow
+- `JIRA_HOST` and `JIRA_SCHEMA_ID` are still needed (infrastructure settings)
+
+### AI API Keys
+- `ANTHROPIC_API_KEY` can be removed from global env - users configure their own keys
+- `OPENAI_API_KEY` can be removed from global env - users configure their own keys
+- `TAVILY_API_KEY` can be removed from global env - users configure their own keys
+- These are now stored per-user in the `user_settings` table (encrypted)
+
+### Authentication Flow
+1. On first run, migrations create database tables
+2. If `ADMIN_EMAIL` and `ADMIN_PASSWORD` are set, initial admin user is created
+3. Once users exist, authentication is automatically required
+4. Users can log in with email/password (local auth) or OAuth (if configured)
+5. User menu shows logged-in user with links to Profile and Settings
+6. Logout is available for all authenticated users
+
+## 🚀 Next Steps
+
+1. Set `LOCAL_AUTH_ENABLED=true` in environment
+2. Configure SMTP settings for email functionality
+3. Generate encryption key: `openssl rand -base64 32`
+4. Set initial admin credentials (optional)
+5. Run the application - migrations will run automatically
+6. Log in with admin account
+7. Create additional users via User Management
+8. Configure roles and permissions as needed
+
+## ⚠️ Important
+
+- Once users exist in the database, authentication is **automatically required**
+- Service account mode only works if no users exist AND local auth is not enabled
+- All API routes are protected - unauthenticated requests return 401
+- User-specific settings (Jira PAT, AI keys) are encrypted at rest