Add multi-user auth system and admin panel

- User model with email/hashed_password/is_admin/notification_prefs
- JWT auth: POST /api/auth/register, /login, /me
- First registered user auto-promoted to admin
- Migration 0005: users table + user_id FK on follows (clears global follows)
- Follows, dashboard, settings, admin endpoints all require authentication
- Admin endpoints (settings writes, celery triggers) require is_admin
- Frontend: login/register pages, Zustand auth store (localStorage persist)
- AuthGuard component gates all app routes, shows app shell only when authed
- Sidebar shows user email + logout; Admin nav link visible to admins only
- Admin panel (/settings): user list with delete + promote/demote, LLM config,
  data source settings, and manual celery controls

Authored-By: Jack Levy

backend/app/api/settings.py

@@ -3,15 +3,20 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.config import settings
+from app.core.dependencies import get_current_admin, get_current_user
 from app.database import get_db
 from app.models import AppSetting
+from app.models.user import User
 from app.schemas.schemas import SettingUpdate, SettingsResponse
 
 router = APIRouter()
 
 
 @router.get("", response_model=SettingsResponse)
-async def get_settings(db: AsyncSession = Depends(get_db)):
+async def get_settings(
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     """Return current effective settings (env + DB overrides)."""
     # DB overrides take precedence over env vars
     overrides: dict[str, str] = {}
@@ -29,7 +34,11 @@ async def get_settings(db: AsyncSession = Depends(get_db)):
 
 
 @router.put("")
-async def update_setting(body: SettingUpdate, db: AsyncSession = Depends(get_db)):
+async def update_setting(
+    body: SettingUpdate,
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(get_current_admin),
+):
     """Update a runtime setting."""
     ALLOWED_KEYS = {"llm_provider", "llm_model", "congress_poll_interval_minutes"}
     if body.key not in ALLOWED_KEYS:
@@ -46,7 +55,7 @@ async def update_setting(body: SettingUpdate, db: AsyncSession = Depends(get_db)
 
 
 @router.post("/test-llm")
-async def test_llm_connection():
+async def test_llm_connection(current_user: User = Depends(get_current_admin)):
     """Test that the configured LLM provider responds correctly."""
     from app.services.llm_service import get_llm_provider
     try: