Add dashboard login and per-user data scoping

[kv4u]

Summary

The web dashboard had no authentication: anyone who could reach the server could browse every project and session. This was the top item on the README roadmap.

• Login: /login and /logout use session auth. Login is rate-limited to 5 attempts per minute, and every dashboard route now requires sign-in.
• No public registration: accounts are created on the server with php artisan movez:user <email>, which asks for a password of at least 12 characters.
• Per-user scoping: dashboard stats, projects, sessions and the migration wizard's project list only show the signed-in user's data. Other users' projects and sessions return 404, and the wizard rejects another user's project_id.
• Unchanged: the sync API still uses Bearer tokens, not the login session.
• Demo login: the seeder creates demo@movez.test / password, but only when APP_ENV is local or testing.
• End-to-end tests: the Playwright suite signs in once through a setup project and saves that session. A new auth spec covers the guest redirect and a wrong password. CI now runs the suite.
• Docs: the README, sync server guide and web README explain account creation, and the "no login yet" warnings are removed.

Test plan

• cd web && php artisan test: 39 passed, including new auth, throttling, movez:user and cross-user isolation tests
• npm run type-check and npm run build are clean
• Playwright locally against the dev server: 14 passed
• Checked by hand in the browser: a guest is redirected to /login, sign-in returns to the page originally requested, the dashboard shows only the user's own data, and sign-out works
• The new Playwright CI step hasn't run on GitHub yet

🤖 Generated with Claude Code