S11: Account and authentication lifecycle

[xishell]

Persona

Any user (visiting boater, berth tenant, harbor master)

User outcome

As any user of DockPulse, I create an account, sign in, manage my profile, and delete my data — so I can use the system safely and within GDPR expectations.

Auth lifecycle for boat owners and harbor masters. Includes role distinction so harbormaster privileges (alerts, configuration, sub-accounts) only show for the right users.

Acceptance Criteria

• User can register with email + password
• User can log in and stay signed in across sessions
• User can log out cleanly
• User can update profile info from a settings page
• User can delete their account and all associated data
• Harbormaster role is distinguished in the DB; privileges enforced server-side
• Bootstrap flow exists for creating the first harbormaster account on a fresh deploy (CLI script in tools/)