P0: tc-auth local sessions, tc-api P0 endpoints, teamclaw-server binary

- tc-auth: argon2id passwords, hashed opaque bearer tokens in auth_sessions
  (migration 0002), anti-enumeration login errors, redacted token Debug
- tc-api: axum router with /healthz, /api/auth/login|logout, /api/user/me,
  /api/team/{claws,credits,permissions}; Authed bearer extractor + RBAC
  permission derivation; integration-tested over real TCP vs real Postgres
- teamclaw-server: config -> pool -> self-migrate -> serve

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/tc-api/src/routes/identity.rs

@@ -0,0 +1,13 @@
+use axum::extract::State;
+use axum::Json;
+use tc_domain::User;
+
+use crate::{ApiError, AppState, Authed};
+
+pub async fn me(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+) -> Result<Json<User>, ApiError> {
+    let me = tc_db::repo::users::get(&state.pool, user.user_id).await?;
+    Ok(Json(me))
+}