Add multi-user auth system and admin panel

- User model with email/hashed_password/is_admin/notification_prefs
- JWT auth: POST /api/auth/register, /login, /me
- First registered user auto-promoted to admin
- Migration 0005: users table + user_id FK on follows (clears global follows)
- Follows, dashboard, settings, admin endpoints all require authentication
- Admin endpoints (settings writes, celery triggers) require is_admin
- Frontend: login/register pages, Zustand auth store (localStorage persist)
- AuthGuard component gates all app routes, shows app shell only when authed
- Sidebar shows user email + logout; Admin nav link visible to admins only
- Admin panel (/settings): user list with delete + promote/demote, LLM config,
  data source settings, and manual celery controls

Authored-By: Jack Levy

frontend/lib/api.ts

@@ -17,6 +17,48 @@ const apiClient = axios.create({
   timeout: 30000,
 });
 
+// Attach JWT from localStorage on every request
+apiClient.interceptors.request.use((config) => {
+  if (typeof window !== "undefined") {
+    try {
+      const stored = localStorage.getItem("pocketveto-auth");
+      if (stored) {
+        const { state } = JSON.parse(stored);
+        if (state?.token) {
+          config.headers.Authorization = `Bearer ${state.token}`;
+        }
+      }
+    } catch {
+      // ignore parse errors
+    }
+  }
+  return config;
+});
+
+interface AuthUser {
+  id: number;
+  email: string;
+  is_admin: boolean;
+  notification_prefs: Record<string, unknown>;
+  created_at: string;
+}
+
+interface TokenResponse {
+  access_token: string;
+  token_type: string;
+  user: AuthUser;
+}
+
+// Auth
+export const authAPI = {
+  register: (email: string, password: string) =>
+    apiClient.post<TokenResponse>("/api/auth/register", { email, password }).then((r) => r.data),
+  login: (email: string, password: string) =>
+    apiClient.post<TokenResponse>("/api/auth/login", { email, password }).then((r) => r.data),
+  me: () =>
+    apiClient.get<AuthUser>("/api/auth/me").then((r) => r.data),
+};
+
 // Bills
 export const billsAPI = {
   list: (params?: Record<string, unknown>) =>
@@ -73,8 +115,24 @@ export const settingsAPI = {
     apiClient.post("/api/settings/test-llm").then((r) => r.data),
 };
 
+export interface AdminUser {
+  id: number;
+  email: string;
+  is_admin: boolean;
+  follow_count: number;
+  created_at: string;
+}
+
 // Admin
 export const adminAPI = {
+  // Users
+  listUsers: () =>
+    apiClient.get<AdminUser[]>("/api/admin/users").then((r) => r.data),
+  deleteUser: (id: number) =>
+    apiClient.delete(`/api/admin/users/${id}`),
+  toggleAdmin: (id: number) =>
+    apiClient.patch<AdminUser>(`/api/admin/users/${id}/toggle-admin`).then((r) => r.data),
+  // Tasks
   triggerPoll: () =>
     apiClient.post("/api/admin/trigger-poll").then((r) => r.data),
   triggerMemberSync: () =>