feat(server): add POST /api/auth/register and /api/auth/login

- Add register endpoint with email/password validation, bcrypt hashing
- Add login endpoint with rate limiting per IP (5 attempts/min)
- Add helper functions: validatePassword, hashPassword, comparePassword, isAdminEmail
- Add checkLoginRateLimit for brute-force protection
- Add bcrypt dependency
- Remove avatarType column from User (migration)

server/prisma/schema.prisma

@@ -82,7 +82,6 @@ model User {
   lastName     String?
   gender       String?
   avatar       String?
-  avatarType   String?
   avatarStyle  String?
   passwordHash String?
   createdAt    DateTime @default(now())