# Implement JWT authentication

Add user authentication with JWT tokens for register and login endpoints.

## What to Create

1. **Install dependencies**:
   - `bcrypt` - Password hashing
   - `jsonwebtoken` - JWT token generation
   - `@types/bcrypt`, `@types/jsonwebtoken` (dev)

2. **Create auth utility** in `src/utils/auth.ts`:
   - `hashPassword(password: string): Promise<string>` - Hash with bcrypt (10 rounds)
   - `comparePassword(password: string, hash: string): Promise<boolean>`
   - `generateToken(userId: string): string` - Generate JWT (expires in 1h)
   - `generateRefreshToken(userId: string): string` - Refresh token (expires in 7d)
   - `verifyToken(token: string): { userId: string }` - Verify and decode JWT

3. **Create auth middleware** in `src/middleware/auth.ts`:
   - `authenticate` middleware:
     - Extract token from `Authorization: Bearer <token>` header
     - Verify token
     - Attach `req.user = { userId }` to request
     - Return 401 if token invalid/missing

4. **Create auth controller** in `src/controllers/auth.ts`:
   - `register`:
     - Validate: email, password (min 8 chars), name
     - Check if user exists (return 400 if yes)
     - Hash password
     - Create user in database
     - Generate tokens
     - Return: `{ user: { id, email, name }, accessToken, refreshToken }`
   - `login`:
     - Validate: email, password
     - Find user by email (return 401 if not found)
     - Compare password (return 401 if wrong)
     - Generate tokens
     - Return: `{ user: { id, email, name }, accessToken, refreshToken }`
   - `refresh`:
     - Validate refresh token
     - Generate new access token
     - Return: `{ accessToken }`

5. **Create auth routes** in `src/routes/auth.ts`:
   - `POST /api/auth/register` → auth.register
   - `POST /api/auth/login` → auth.login
   - `POST /api/auth/refresh` → auth.refresh

6. **Update config** in `src/config/index.ts`:
   - Add to `.env.example`: `JWT_SECRET`, `JWT_REFRESH_SECRET`
   - Export JWT secrets from config

7. **Add request type** in `src/types/express.d.ts`:
   ```typescript
   declare namespace Express {
     interface Request {
       user?: { userId: string };
     }
   }
   ```

## Acceptance

- `POST /api/auth/register` with `{ email, password, name }` creates user and returns tokens
- `POST /api/auth/login` with `{ email, password }` returns tokens
- `POST /api/auth/refresh` with `{ refreshToken }` returns new access token
- Passwords are hashed (not stored in plain text)
- Invalid credentials return 401
- Duplicate email returns 400
- Auth middleware attaches user to request
