- Add User entity with roles (Admin, Student)
- Create JWT service for token generation/validation
- Create password service using PBKDF2
- Add login and register GraphQL mutations
- Apply [Authorize] attributes to protected mutations
- DeleteStudent requires Admin role
- UpdateStudent/Enroll/Unenroll require owner or admin
- Add admin user creation on startup
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>