feat(auth): интегрировать SSO auth-portal

JWT на backend, handoff/callback на UI, RBAC mm:*, AUTH_* в compose.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/run-beside-cdn-traefik.sh

@@ -109,6 +109,10 @@ docker run -d \
   -e PORT=8000 \
   -e DATABASE_PATH=/app/data/mikrotik.db \
   -e "CORS_ORIGIN=${CORS_ORIGIN}" \
+  -e "AUTH_REQUIRED=${AUTH_REQUIRED:-true}" \
+  -e "AUTH_JWT_SECRET=${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET}" \
+  -e "AUTH_ISSUER=${AUTH_ISSUER:-https://auth.shnt.top}" \
+  -e "AUTH_PORTAL_URL=${AUTH_PORTAL_URL:-https://auth.shnt.top}" \
   -v "${MM_ROOT}/data:/app/data" \
   --label mmapp.updater.managed=true \
   --label mmapp.updater.target=backend \