Add users, roles, and per-novel permissions

Introduces accounts (ASP.NET Identity + cookie auth), four global
roles (Admin/Writer/Editor/Reviewer), per-novel ownership and grants
via ProjectMember, and a service-API-key principal for the MCP server
and background import jobs. Enforcement lives in the application
services (not endpoint filters) so the embedded agent and MCP tools,
which call the same services directly, can't bypass it. Web client
gets a login page, session-aware routing, and a People section for
managing per-novel access.

Also includes prior in-flight changes from this branch (CLAUDE.md
compliance pass, dev-deploy docker-compose setup) that were
uncommitted when this feature work started.

src/Novelly.Api/Program.cs

@@ -1,3 +1,4 @@
+using System.Diagnostics.CodeAnalysis;
 using System.Text.Json.Serialization;
 using Microsoft.AspNetCore.Diagnostics;
 using Microsoft.EntityFrameworkCore;
@@ -12,6 +13,7 @@ using Novelly.Api.Imports;
 using Novelly.Api.Projects;
 using Novelly.Api.Questions;
 using Novelly.Api.Tags;
+using Novelly.Api.Users;
 using Serilog;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -35,13 +37,16 @@ var corsOrigins = builder.Configuration.GetSection("Cors:Origins").Get<string[]>
 builder.Services.AddCors(options => options.AddDefaultPolicy(policy => policy
     .WithOrigins(corsOrigins)
     .AllowAnyHeader()
-    .AllowAnyMethod()));
+    .AllowAnyMethod()
+    .AllowCredentials()));
 
 var app = builder.Build();
 
 using (var scope = app.Services.CreateScope())
 {
-    await scope.ServiceProvider.GetRequiredService<NovelDbContext>().Database.MigrateAsync();
+    var db = scope.ServiceProvider.GetRequiredService<NovelDbContext>();
+    await db.Database.MigrateAsync();
+    await ServiceUser.EnsureSeededAsync(db, builder.Configuration[ServiceApiKeyAuthenticationHandler.ConfigurationKey], app.Logger);
 }
 
 app.UseSerilogRequestLogging();
@@ -53,18 +58,15 @@ app.UseExceptionHandler(handler => handler.Run(async context =>
     var (status, title) = exception switch
     {
         AgentNotConfiguredException => (StatusCodes.Status503ServiceUnavailable, "Agent unavailable"),
+        NotAuthorizedException => (StatusCodes.Status403Forbidden, "Forbidden"),
         ArgumentException or InvalidOperationException => (StatusCodes.Status400BadRequest, "Invalid request"),
         _ => (StatusCodes.Status500InternalServerError, "Unexpected error")
     };
 
-    if (status == StatusCodes.Status500InternalServerError)
-    {
-        app.Logger.LogError(exception, "Unhandled exception on {Path}", context.Request.Path);
-    }
-    else
-    {
-        app.Logger.LogWarning(exception, "Handled {StatusCode} on {Path}: {Title}", status, context.Request.Path, title);
-    }
+    app.Logger.Log(
+        status == StatusCodes.Status500InternalServerError ? LogLevel.Error : LogLevel.Warning,
+        exception,
+        "Handled {StatusCode} on {Path}: {Title}", status, context.Request.Path, title);
 
     await Results
         .Problem(title: title, detail: exception?.Message, statusCode: status)
@@ -73,6 +75,9 @@ app.UseExceptionHandler(handler => handler.Run(async context =>
 
 app.UseCors();
 
+app.UseAuthentication();
+app.UseAuthorization();
+
 if (app.Environment.IsDevelopment())
 {
     app.MapOpenApi();
@@ -80,7 +85,10 @@ if (app.Environment.IsDevelopment())
 
 app.MapDefaultEndpoints();
 
-app.MapGet("/api/health", () => Results.Ok(new { status = "ok" })).WithTags("Health");
+app.MapGet("/api/health", () => Results.Ok(new { status = "ok" })).WithTags("Health").AllowAnonymous();
+
+app.MapUserEndpoints();
+app.MapProjectMemberEndpoints();
 
 app.MapProjectEndpoints()
    .MapCharacterEndpoints()
@@ -94,4 +102,5 @@ app.MapProjectEndpoints()
 
 app.Run();
 
+[ExcludeFromCodeCoverage]
 public partial class Program;