Add user authentication

### Description

Implement a standard JSON Web Token (JWT) based authentication and authorization system to secure API endpoints, enable stateless operation, and support client-side token management.

### Acceptance Criteria

All previously unprotected routes are now secured. Users must log in to access protected data. The system correctly generates, validates, and rejects expired/invalid tokens.
