feat(web): add login page, auth store, API client, and route guard

- API client with axios interceptors: JWT attach + 401 auto-refresh
- Auth store (Zustand): login/logout/loadFromStorage with localStorage
- Login page: gradient background, Ant Design form, error handling
- Home page: dashboard with statistics cards
- App.tsx: PrivateRoute guard, /login route, auth state restoration
- MainLayout: dynamic user display, logout dropdown, menu navigation
- Users API service: CRUD with pagination support

apps/web/src/stores/auth.ts

@@ -0,0 +1,56 @@
+import { create } from 'zustand';
+import { login as apiLogin, logout as apiLogout, type UserInfo } from '../api/auth';
+
+interface AuthState {
+  user: UserInfo | null;
+  isAuthenticated: boolean;
+  loading: boolean;
+  login: (username: string, password: string) => Promise<void>;
+  logout: () => Promise<void>;
+  loadFromStorage: () => void;
+}
+
+export const useAuthStore = create<AuthState>((set) => ({
+  user: null,
+  isAuthenticated: false,
+  loading: false,
+
+  login: async (username, password) => {
+    set({ loading: true });
+    try {
+      const resp = await apiLogin({ username, password });
+      localStorage.setItem('access_token', resp.access_token);
+      localStorage.setItem('refresh_token', resp.refresh_token);
+      localStorage.setItem('user', JSON.stringify(resp.user));
+      set({ user: resp.user, isAuthenticated: true, loading: false });
+    } catch (error) {
+      set({ loading: false });
+      throw error;
+    }
+  },
+
+  logout: async () => {
+    try {
+      await apiLogout();
+    } catch {
+      // Ignore logout API errors
+    }
+    localStorage.removeItem('access_token');
+    localStorage.removeItem('refresh_token');
+    localStorage.removeItem('user');
+    set({ user: null, isAuthenticated: false });
+  },
+
+  loadFromStorage: () => {
+    const token = localStorage.getItem('access_token');
+    const userStr = localStorage.getItem('user');
+    if (token && userStr) {
+      try {
+        const user = JSON.parse(userStr) as UserInfo;
+        set({ user, isAuthenticated: true });
+      } catch {
+        localStorage.removeItem('user');
+      }
+    }
+  },
+}));