Implement JWT authentication and app passkey support

- Add JWT token generation and validation
- Implement bcrypt password hashing
- Create auth service with register/login/refresh/logout
- Add app passkey generation and management
- Implement protected routes and auth middleware
- Add comprehensive tests for new functionality

internal/auth/token_test.go

@@ -0,0 +1,59 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGenerateToken(t *testing.T) {
+	raw, hash, err := GenerateToken()
+	if err != nil {
+		t.Fatalf("GenerateToken = %v", err)
+	}
+
+	if !strings.HasPrefix(raw, tokenPrefix) {
+		t.Errorf("raw token %q does not start with %q", raw, tokenPrefix)
+	}
+
+	expectedHash := HashToken(raw)
+	if hash != expectedHash {
+		t.Errorf("hash = %q, want %q", hash, expectedHash)
+	}
+}
+
+func TestGenerateTokenUniqueness(t *testing.T) {
+	raw1, _, _ := GenerateToken()
+	raw2, _, _ := GenerateToken()
+
+	if raw1 == raw2 {
+		t.Fatal("two generated tokens should not be equal")
+	}
+}
+
+func TestGenerateTokenLength(t *testing.T) {
+	raw, _, err := GenerateToken()
+	if err != nil {
+		t.Fatalf("GenerateToken = %v", err)
+	}
+
+	expectedLen := len(tokenPrefix) + tokenByteLen*2 // hex encodes each byte as 2 chars
+	if len(raw) != expectedLen {
+		t.Errorf("token length = %d, want %d", len(raw), expectedLen)
+	}
+}
+
+func TestHashTokenDeterministic(t *testing.T) {
+	hash1 := HashToken("mygo_test_token")
+	hash2 := HashToken("mygo_test_token")
+	if hash1 != hash2 {
+		t.Fatal("HashToken should be deterministic")
+	}
+}
+
+func TestHashTokenDifferent(t *testing.T) {
+	hash1 := HashToken("mygo_aaa")
+	hash2 := HashToken("mygo_bbb")
+	if hash1 == hash2 {
+		t.Fatal("different inputs should produce different hashes")
+	}
+}