feat: add app-level authentication foundation

docs/admin-api.md

@@ -22,6 +22,7 @@
 ## 3. Основные ресурсы
 
 - `workspaces`
+- `auth`
 - `memberships`
 - `invitations`
 - `operations`
@@ -60,7 +61,20 @@
 - `POST /invitations` возвращает metadata invitation и одноразовый `invite_token`;
 - `invite_token` доступен только в create-response и не возвращается повторно в list endpoints.
 
-### 5.2. Operations
+### 5.2. Auth and session
+
+- `POST /api/auth/login`
+- `POST /api/auth/logout`
+- `GET /api/auth/session`
+
+Контракт:
+
+- `POST /login` принимает `email` и `password`;
+- при успешном логине backend выставляет `HttpOnly` session cookie;
+- `GET /session` возвращает текущего пользователя и memberships;
+- `POST /logout` инвалидирует текущую session.
+
+### 5.3. Operations
 
 - `GET /api/admin/workspaces/{workspace_id}/operations`
 - `POST /api/admin/workspaces/{workspace_id}/operations`
@@ -75,7 +89,7 @@
 - `GET /api/admin/workspaces/{workspace_id}/operations/{operation_id}/export`
 - `POST /api/admin/workspaces/{workspace_id}/operations/import`
 
-### 5.3. Samples and descriptors
+### 5.4. Samples and descriptors
 
 - `POST /api/admin/workspaces/{workspace_id}/operations/{operation_id}/samples/input-json`
 - `POST /api/admin/workspaces/{workspace_id}/operations/{operation_id}/samples/output-json`
@@ -84,7 +98,7 @@
 - `POST /api/admin/workspaces/{workspace_id}/operations/{operation_id}/descriptors/descriptor-set`
 - `GET /api/admin/workspaces/{workspace_id}/operations/{operation_id}/grpc/services`
 
-### 5.4. Upstream auth profiles
+### 5.5. Upstream auth profiles
 
 - `GET /api/admin/workspaces/{workspace_id}/auth-profiles`
 - `POST /api/admin/workspaces/{workspace_id}/auth-profiles`
@@ -92,7 +106,7 @@
 - `PATCH /api/admin/workspaces/{workspace_id}/auth-profiles/{auth_profile_id}`
 - `DELETE /api/admin/workspaces/{workspace_id}/auth-profiles/{auth_profile_id}`
 
-### 5.5. Agents
+### 5.6. Agents
 
 - `GET /api/admin/workspaces/{workspace_id}/agents`
 - `POST /api/admin/workspaces/{workspace_id}/agents`
@@ -105,7 +119,7 @@
 - `POST /api/admin/workspaces/{workspace_id}/agents/{agent_id}/bindings`
 - `DELETE /api/admin/workspaces/{workspace_id}/agents/{agent_id}/bindings/{operation_id}`
 
-### 5.6. Platform API keys
+### 5.7. Platform API keys
 
 - `GET /api/admin/workspaces/{workspace_id}/platform-api-keys`
 - `POST /api/admin/workspaces/{workspace_id}/platform-api-keys`
@@ -118,7 +132,7 @@
 - `secret` доступен только в create-response;
 - list endpoints возвращают только metadata, `prefix`, `status`, `scopes` и `last_used_at`.
 
-### 5.7. Observability
+### 5.8. Observability
 
 - `GET /api/admin/workspaces/{workspace_id}/logs`
 - `GET /api/admin/workspaces/{workspace_id}/logs/{log_id}`