Authentication system for web GUI

Currently relies on trusted LAN/Tailscale network.

- Session-based auth with password
- API key support for programmatic access  
- Future: Tailscale auth integration
- Required before shipping to other users