feat: session auth + per-user/persona UI at /{user}/{persona}

Replaces nginx basic auth with a proper per-user session system:

- auth_utils.py: bcrypt password hashing, JWT cookie creation/decode
- auth_middleware.py: validates JWT cookie on all routes except /login,
  /health, /static/, and webhook endpoints (/channels/, /webhook/)
- routers/ui.py: GET /login, POST /login, POST /logout,
  GET /{username}/{persona} — serves index.html with CORTEX_CONFIG injected
- static/login.html: minimal login form (dark theme, matches UI)
- main.py: registers SessionAuthMiddleware + ui.router
- config.py: jwt_secret, jwt_expire_days settings
- manage_passwords.py: CLI tool to set/check/list user passwords
- app.js: reads window.CORTEX_CONFIG (user + persona), sends both on
  every /chat and /orchestrate request; persona name shown in header;
  logout button (⏏) added to header
- requirements.txt: bcrypt, PyJWT, python-multipart
- .env.default: JWT_SECRET, JWT_EXPIRE_DAYS documented
- tests: client fixture injects JWT cookie; security test assertions
  updated for URL-normalized path traversal paths (still secure, codes differ)

All 80 tests pass.

Setup for a new user:
  python manage_passwords.py set scott
  python manage_passwords.py set holly

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/static/index.html

@@ -23,13 +23,16 @@
     <header>
         <span class="header-emoji">✨</span>
         <div>
-            <div class="name">Inara</div>
+            <div class="name" id="persona-name">Inara</div>
             <div class="subtitle">Cortex · Local</div>
         </div>
         <button id="sessions-btn" class="hdr-btn">Sessions</button>
         <button id="files-btn" class="hdr-btn">Files</button>
         <button id="ctx-open-btn" class="hdr-btn" title="Settings">⚙<span class="tier-badge">2</span></button>
         <button id="help-btn" class="hdr-btn" title="Help &amp; reference">?</button>
+        <form method="POST" action="/logout" style="margin:0">
+            <button type="submit" class="hdr-btn" title="Sign out" id="logout-btn">⏏</button>
+        </form>
 
         <div id="sessions-panel"></div>