feat: Phase 1 scaffold — frontend canvas + backend skeleton

Frontend:
- Vite + React 18 + TypeScript + Tailwind v4 + Shadcn/ui
- React Flow v12 canvas with all 11 node types and 5 edge types
- Dark theme with project design system (cyan, green, orange, purple accents)
- Collapsible sidebar, toolbar, detail panel
- Zustand store for canvas state
- Demo data with 10 nodes and 10 edges

Backend:
- FastAPI + SQLAlchemy async + SQLite (Python 3.13)
- DB models: Node, Edge, CanvasState, PendingDevice, ScanRun
- REST API routes: auth, nodes, edges, canvas, scan, status (WebSocket)
- JWT auth + bcrypt via config.yml
- Pydantic v2 schemas

Infra:
- GitHub Actions quality + security workflows
- .gitignore, .env.example, verify-tooling.sh, security-check.sh

backend/app/api/routes/auth.py

@@ -0,0 +1,34 @@
+import yaml
+from fastapi import APIRouter, HTTPException, status
+from pydantic import BaseModel
+
+from app.core.config import settings
+from app.core.security import create_access_token, verify_password
+
+router = APIRouter()
+
+
+class LoginRequest(BaseModel):
+    username: str
+    password: str
+
+
+class TokenResponse(BaseModel):
+    access_token: str
+    token_type: str = "bearer"
+
+
+def _load_credentials() -> tuple[str, str]:
+    with open(settings.config_path) as f:
+        cfg = yaml.safe_load(f)
+    auth = cfg.get("auth", {})
+    return auth.get("username", "admin"), auth.get("password_hash", "")
+
+
+@router.post("/login", response_model=TokenResponse)
+async def login(body: LoginRequest):
+    username, password_hash = _load_credentials()
+    if body.username != username or not verify_password(body.password, password_hash):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
+    token = create_access_token(body.username)
+    return TokenResponse(access_token=token)