R. Yusup

[Yusuprozimemet]

• Add JJWT 0.12.6 dependencies and load secrets from a local .env file
• Create JwtService to generate and verify signed tokens (15 min default
  lifetime, configurable via JWT_EXPIRATION_MS)
• Create JwtAuthenticationFilter to authenticate requests from the
  Authorization: Bearer header
• Create AppUserDetailsService to load users from the database for
  Spring Security
• Configure stateless security: /users/register and /auth/login are
  public, everything else requires a valid token, failures return 401
• Hash passwords with BCrypt on registration and reject duplicate
  usernames with 409
• Add authenticated GET /users/profile endpoint and .env.example