P0: tc-auth local sessions, tc-api P0 endpoints, teamclaw-server binary

- tc-auth: argon2id passwords, hashed opaque bearer tokens in auth_sessions
  (migration 0002), anti-enumeration login errors, redacted token Debug
- tc-api: axum router with /healthz, /api/auth/login|logout, /api/user/me,
  /api/team/{claws,credits,permissions}; Authed bearer extractor + RBAC
  permission derivation; integration-tested over real TCP vs real Postgres
- teamclaw-server: config -> pool -> self-migrate -> serve

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/tc-api/src/routes/health.rs

@@ -0,0 +1,6 @@
+use axum::http::StatusCode;
+
+/// Liveness probe; deliberately unauthenticated so orchestrators can use it.
+pub async fn healthz() -> StatusCode {
+    StatusCode::OK
+}