Role-based login

This is the first concrete auth foundation for WeeQ OS. It now supports login action wiring, role redirects, and the base setup/reset flow surfaces.