Add multi-user auth system and admin panel

- User model with email/hashed_password/is_admin/notification_prefs
- JWT auth: POST /api/auth/register, /login, /me
- First registered user auto-promoted to admin
- Migration 0005: users table + user_id FK on follows (clears global follows)
- Follows, dashboard, settings, admin endpoints all require authentication
- Admin endpoints (settings writes, celery triggers) require is_admin
- Frontend: login/register pages, Zustand auth store (localStorage persist)
- AuthGuard component gates all app routes, shows app shell only when authed
- Sidebar shows user email + logout; Admin nav link visible to admins only
- Admin panel (/settings): user list with delete + promote/demote, LLM config,
  data source settings, and manual celery controls

Authored-By: Jack Levy

backend/app/models/__init__.py

@@ -6,6 +6,7 @@ from app.models.news import NewsArticle
 from app.models.setting import AppSetting
 from app.models.trend import TrendScore
 from app.models.committee import Committee, CommitteeBill
+from app.models.user import User
 
 __all__ = [
     "Bill",
@@ -19,4 +20,5 @@ __all__ = [
     "TrendScore",
     "Committee",
     "CommitteeBill",
+    "User",
 ]

backend/app/models/follow.py

@@ -1,4 +1,5 @@
-from sqlalchemy import Column, Integer, String, DateTime, UniqueConstraint
+from sqlalchemy import Column, DateTime, ForeignKey, Integer, String, UniqueConstraint
+from sqlalchemy.orm import relationship
 from sqlalchemy.sql import func
 
 from app.database import Base
@@ -8,10 +9,13 @@ class Follow(Base):
     __tablename__ = "follows"
 
     id = Column(Integer, primary_key=True, autoincrement=True)
+    user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
     follow_type = Column(String(20), nullable=False)   # bill | member | topic
     follow_value = Column(String, nullable=False)       # bill_id | bioguide_id | tag string
     created_at = Column(DateTime(timezone=True), server_default=func.now())
 
+    user = relationship("User", back_populates="follows")
+
     __table_args__ = (
-        UniqueConstraint("follow_type", "follow_value", name="uq_follows_type_value"),
+        UniqueConstraint("user_id", "follow_type", "follow_value", name="uq_follows_user_type_value"),
     )

backend/app/models/user.py

@@ -0,0 +1,19 @@
+from sqlalchemy import Boolean, Column, DateTime, Integer, String
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class User(Base):
+    __tablename__ = "users"
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    email = Column(String, unique=True, nullable=False, index=True)
+    hashed_password = Column(String, nullable=False)
+    is_admin = Column(Boolean, nullable=False, default=False)
+    notification_prefs = Column(JSONB, nullable=False, default=dict)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+
+    follows = relationship("Follow", back_populates="user", cascade="all, delete-orphan")