feat(auth): email verification login and personal access tokens

* feat(auth): add email verification login flow with 401 auto-redirect

Replace the old OAuth-based login with email verification codes:
- Backend: send-code / verify-code endpoints, verification_codes table (migration 009), rate limiting, Resend email service
- Frontend: two-step login UI (email → 6-digit OTP), auth store with sendCode/verifyCode
- SDK: ApiClient gains onUnauthorized callback; 401 responses auto-clear token and redirect to /login
- Fix login button staying disabled due to global isLoading state

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(auth): add brute-force protection, redirect loop guard, and expired code cleanup

- VerifyCode: increment attempts on wrong code, reject after 5 failed tries (migration 010)
- onUnauthorized: skip redirect if already on /login to prevent infinite loops
- SendCode: best-effort cleanup of expired verification codes older than 1 hour

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(auth): add master verification code for non-production environments

Allow code "888888" to bypass email verification in non-production
environments to simplify development and testing workflows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(auth): add personal access tokens for CLI and API authentication

Add full-stack PAT support: users create tokens in Settings, CLI authenticates
via `multica auth login`. Server stores SHA-256 hashes only. Auth middleware
extended to accept both JWTs and PATs (distinguished by `mul_` prefix).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/sdk/src/api-client.ts

@@ -23,6 +23,9 @@ import type {
   CreateSkillRequest,
   UpdateSkillRequest,
   SetAgentSkillsRequest,
+  PersonalAccessToken,
+  CreatePersonalAccessTokenRequest,
+  CreatePersonalAccessTokenResponse,
 } from "@multica/types";
 import { type SDKLogger, noopLogger } from "./logger";
 
@@ -36,6 +39,7 @@ export class ApiClient {
   private token: string | null = null;
   private workspaceId: string | null = null;
   private logger: SDKLogger;
+  private onUnauthorized: (() => void) | null = null;
 
   constructor(baseUrl: string, options?: { logger?: SDKLogger }) {
     this.baseUrl = baseUrl;
@@ -50,6 +54,10 @@ export class ApiClient {
     this.workspaceId = id;
   }
 
+  setOnUnauthorized(callback: (() => void) | null) {
+    this.onUnauthorized = callback;
+  }
+
   private async fetch<T>(path: string, init?: RequestInit): Promise<T> {
     const rid = crypto.randomUUID().slice(0, 8);
     const start = Date.now();
@@ -75,6 +83,9 @@ export class ApiClient {
     });
 
     if (!res.ok) {
+      if (res.status === 401 && this.onUnauthorized) {
+        this.onUnauthorized();
+      }
       let message = `API error: ${res.status} ${res.statusText}`;
       try {
         const data = await res.json() as { error?: string };
@@ -99,10 +110,17 @@ export class ApiClient {
   }
 
   // Auth
-  async login(email: string, name?: string): Promise<LoginResponse> {
-    return this.fetch("/auth/login", {
+  async sendCode(email: string): Promise<{ message: string }> {
+    return this.fetch("/auth/send-code", {
       method: "POST",
-      body: JSON.stringify({ email, name }),
+      body: JSON.stringify({ email }),
+    });
+  }
+
+  async verifyCode(email: string, code: string): Promise<LoginResponse> {
+    return this.fetch("/auth/verify-code", {
+      method: "POST",
+      body: JSON.stringify({ email, code }),
     });
   }
 
@@ -362,4 +380,20 @@ export class ApiClient {
       body: JSON.stringify(data),
     });
   }
+
+  // Personal Access Tokens
+  async listPersonalAccessTokens(): Promise<PersonalAccessToken[]> {
+    return this.fetch("/api/tokens");
+  }
+
+  async createPersonalAccessToken(data: CreatePersonalAccessTokenRequest): Promise<CreatePersonalAccessTokenResponse> {
+    return this.fetch("/api/tokens", {
+      method: "POST",
+      body: JSON.stringify(data),
+    });
+  }
+
+  async revokePersonalAccessToken(id: string): Promise<void> {
+    await this.fetch(`/api/tokens/${id}`, { method: "DELETE" });
+  }
 }