feat: passport-local authentication, story ownership

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

migrations/0003_auth.sql

@@ -0,0 +1,26 @@
+-- Up Migration
+CREATE TABLE users (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  username TEXT NOT NULL,
+  password_hash TEXT NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX users_username_lower_idx ON users (lower(username));
+
+-- NULL owner = legacy story from before accounts existed: readable if
+-- published, but editable by nobody.
+ALTER TABLE stories ADD COLUMN owner_id UUID REFERENCES users(id) ON DELETE CASCADE;
+CREATE INDEX stories_owner_idx ON stories (owner_id, updated_at DESC);
+
+CREATE TABLE sessions (
+  sid TEXT PRIMARY KEY,
+  sess JSONB NOT NULL,
+  expire TIMESTAMPTZ NOT NULL
+);
+CREATE INDEX sessions_expire_idx ON sessions (expire);
+
+-- Down Migration
+DROP TABLE sessions;
+DROP INDEX stories_owner_idx;
+ALTER TABLE stories DROP COLUMN owner_id;
+DROP TABLE users;