feat: add cookie-based auth and user management APIs

[sankara-sabapathy]

Summary

This PR implements a token server and user management layer on top of the existing Express + Mongoose template. It replaces the placeholder user schema with a production-oriented Users/Roles design and adds cookie-based JWT authentication with role-based authorization.

Authentication (/v1/login, /v1/refresh, /v1/me)

• POST /v1/login — validates email/password with bcrypt, blocks inactive/suspended accounts, updates lastLoginAt, and sets httpOnly access_token + refresh_token cookies
• POST /v1/refresh — verifies the refresh cookie and re-issues both tokens
• GET /v1/me — returns the authenticated user's profile with populated role (requires access cookie)

Token strategy: cookie-only (no Bearer header). Access tokens use accessJwtSecret; refresh tokens use refreshJwtSecret. Both carry { userId } in the JWT payload.

User management (/v1/users)

• GET /v1/users — paginated user list with optional status filter (requires users.read permission)
• POST /v1/users — create user with hashed password (requires users.write permission)
• PATCH /v1/users/:id — partial update for name, email, password, role, status (requires users.write permission)

Data model

Users (src/models/users.js):
firstName, lastName, fullName (auto-computed), email (unique), passwordHash, roleId, status (active/inactive/suspended), lastLoginAt, createdBy, updatedBy, soft-delete via isDeleted

Roles (src/models/roles.js):
name, code (unique), description, permissions[], status

Authorization changes

• authenticateByCookie now verifies the access cookie (access_token) instead of the refresh cookie
• authorizeInternalAccess loads permissions from the user's role in the database; users with admin role bypass permission checks

Tooling & config

Addition	Purpose
bcryptjs	Password hashing
scripts/seedRoles.js	Seeds admin and user roles + bootstrap admin user
npm run seed	Run seed script
npm run dev:local	Dev server with in-memory MongoDB + auto-seed
npm run test:local	End-to-end API smoke test
.env.example	New vars: REFRESH_TOKEN_VALIDITY_IN_SECONDS, SEED_ADMIN_EMAIL, SEED_ADMIN_PASSWORD
.gitignore	Ignores cookie jars and .env.local

Breaking changes

• The template users schema (name, username, admin, permissions[]) is replaced with the new design. Existing user documents will not be compatible.
• Notes routes using authorizeInternalAccess now require role-based permissions from the roles collection instead of the inline admin flag.

Test plan

• npm run test:local — all 6 endpoints pass (login, me, refresh, list users, create user, patch user)
• Manual curl against npm run dev:local confirmed login and /me responses
• Seed roles + admin against a real MongoDB instance (npm run seed)
• Verify cookie auth works from a browser client (CORS + credentials)
• Confirm non-admin users cannot access /v1/users without users.read/users.write permissions

Local setup

cp .env.example .env   # set JWT secrets and SEED_ADMIN_EMAIL/PASSWORD
npm run dev:local      # or npm run dev with a real MongoDB
npm run seed           # if using real MongoDB

Default seed credentials: admin@example.com / value of SEED_ADMIN_PASSWORD