feat(auth): интегрировать SSO auth-portal

JWT на backend, handoff/callback на UI, RBAC mm:*, AUTH_* в compose.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/env.traefik.example

@@ -9,6 +9,12 @@ MM_DOMAIN=mm.shnt.top
 # Must match the public HTTPS origin of the UI (same as MM_DOMAIN with https://).
 CORS_ORIGIN=https://mm.shnt.top
 
+# --- Portal SSO (MM backend) ---
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=https://auth.shnt.top
+
 # --- Traefik / Let's Encrypt (only for docker-compose.traefik.yml standalone) ---
 # Not required when attaching to CDNManager Traefik (traefik-cdn / run-beside script).
 CF_DNS_API_TOKEN=