Add winn create auth scaffold + auth guide (#168)

[gregwinn]

Summary

The final piece of the authentication epic (#161): winn create auth scaffolds a complete email/password setup in one command, plus a full docs/auth.md guide. Branched off develop.

winn create auth
#   create  src/models/user.winn
#   create  src/models/auth_token.winn
#   create  db/migrations/<ts>01_create_users.winn
#   create  db/migrations/<ts>02_create_auth_tokens.winn
#   create  src/controllers/auth_controller.winn

The generated AuthController wires all eight endpoints (register / login / refresh / logout / verify / forgot / reset / me) with [:cors, :auth] middleware and an exclude list; the migrations are ordered (01/02) with proper constraints.

Details

• winn_generator: generate(auth, _) + dedicated templates; winn_cli: create auth dispatch + help text.
• Caught a pre-existing bug: the existing model_template emits quoted struct atoms (struct [:"email"]) that don't parse — so winn create model currently generates non-compiling models. The auth scaffold uses a schema-only template that compiles. (Worth a follow-up issue for create model.)
• Fixed non-compiling docs: %{ok: true} in docs/modules.md — ok/err are reserved and can't be map keys (verified it's a parse error); changed to %{status: "ok"}.
• docs/auth.md: end-to-end guide — quick start, token model, a runnable JS frontend example (with silent refresh), cookie mode, account recovery, security notes. docs/cli.md + docs/roadmap.md updated.

Testing

New winn_auth_scaffold_tests runs the generator in a temp dir and compiles the output: the controller compiles + loads with 8 routes and [cors, auth] middleware + an exclude config; both models compile (compiled-not-loaded, so the user beam doesn't clobber OTP's user module). Also verified winn create auth end-to-end via the built escript. Full suite 769, only the pre-existing winn_sqlite_tests esqlite-NIF failure.

Part of #161. Closes #168. This completes the authentication epic — Phases 1–4 all done.

🤖 Generated with Claude Code