feat: add authentication, user management, and admin features

Added comprehensive authentication and authorization system:

Authentication System:
- Better Auth integration with session management
- Login/logout pages and API routes
- Middleware for route protection
- Auth utilities and client libraries

User Management:
- User list, detail, and invite pages
- User API endpoints (CRUD operations)
- Session management for users
- Profile settings page

Role-Based Access Control:
- Role management pages (list, create, edit)
- Permission system with granular controls
- Role assignment to users
- Role API endpoints

Admin Features:
- Audit log page for tracking system events
- Admin settings page
- Audit service for logging user actions

Additional Features:
- Quotes management pages and components
- SalesBldr API integration
- Email service for notifications

Configuration & Documentation:
- Updated docker-compose.yml
- MCP server configuration (mcp.json)
- CVE-2025-55182 security review documentation
- Standards guide and PRD documents
- Re-enabling authentication documentation

Database Migrations:
- 012: Auth tables (users, sessions, accounts, verifications)
- 013: Role tables (roles, permissions, role_permissions, user_roles)
- 014: Admin settings table

UI Updates:
- Updated dashboard layout
- Enhanced app layout with auth integration

middleware.ts

@@ -0,0 +1,70 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import { getSessionCookie } from "better-auth/cookies";
+
+// Routes that don't require authentication
+const publicRoutes = [
+  "/auth/sign-in",
+  "/auth/verify",
+  "/auth/2fa",
+  "/auth/setup",
+  "/api/auth",
+];
+
+// Routes that require admin or super-admin role
+const adminRoutes = ["/admin"];
+
+export async function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  // TEMPORARY: Authentication bypassed for private site access
+  // TODO: Re-enable authentication when site has public access
+  return NextResponse.next();
+
+  // Allow public routes
+  // if (publicRoutes.some((route) => pathname.startsWith(route))) {
+  //   return NextResponse.next();
+  // }
+
+  // // Allow static files and API routes (except admin API)
+  // if (
+  //   pathname.startsWith("/_next") ||
+  //   pathname.startsWith("/favicon") ||
+  //   pathname.includes(".")
+  // ) {
+  //   return NextResponse.next();
+  // }
+
+  // // Check for session cookie
+  // const sessionCookie = getSessionCookie(request);
+
+  // if (!sessionCookie) {
+  //   // Redirect to sign-in if no session
+  //   const signInUrl = new URL("/auth/sign-in", request.url);
+  //   signInUrl.searchParams.set("callbackUrl", pathname);
+  //   return NextResponse.redirect(signInUrl);
+  // }
+
+  // // For admin routes, we need to verify the role
+  // // This is a basic check - the actual role verification happens in the API routes
+  // if (adminRoutes.some((route) => pathname.startsWith(route))) {
+  //   // The session cookie exists, but we can't decode it here without the secret
+  //   // Role-based access control is enforced at the API level
+  //   // This middleware just ensures there's a session
+  //   return NextResponse.next();
+  // }
+
+  // return NextResponse.next();
+}
+
+export const config = {
+  matcher: [
+    /*
+     * Match all request paths except for the ones starting with:
+     * - _next/static (static files)
+     * - _next/image (image optimization files)
+     * - favicon.ico (favicon file)
+     */
+    "/((?!_next/static|_next/image|favicon.ico).*)",
+  ],
+};