Add byte-compatible Auth & SSO core primitives

Pure, unit-tested primitives the AtomCMS->Next.js login must reproduce exactly
(verified now with round-trip + known vectors; full end-to-end check deferred
until a real DB + APP_KEY + live emulator are available):

- password.ts: argon2id (m=65536,t=4,p=1 via hash-wasm) + bcrypt ($2y$ accepted)
  verify, and the md5->argon2id on-login upgrade gated by convert_passwords
  (mirrors RedirectIfTwoFactorAuthenticatable).
- sso-ticket.ts: '{hotel_name without spaces}-{uuidv4}' written to auth_ticket +
  ip_current (mirrors User::ssoTicket()).
- laravel-encrypter.ts: AES-256-CBC + HMAC-SHA256 payload compatible with
  Laravel encrypt()/encryptString (for existing 2FA secrets) incl. PHP string
  (de)serialization.
- totp.ts: otplib Google2FA-compatible TOTP verify (SHA1/6/30).

Libs: hash-wasm + bcryptjs + otplib (pure JS/WASM, no native build). 28 tests.

src/lib/auth/index.ts

@@ -0,0 +1,15 @@
+export {
+  checkLogin,
+  hashPassword,
+  isMd5Of,
+  md5Hex,
+  verifyPassword,
+  type LoginCheck,
+} from "./password";
+export { generateSsoTicket, issueSsoTicket, type SsoUserUpdater } from "./sso-ticket";
+export {
+  LaravelEncrypter,
+  phpSerializeString,
+  phpUnserializeString,
+} from "./laravel-encrypter";
+export { generateTotp, totpKeyUri, verifyTotp } from "./totp";