feat: implement authentication and RBAC

- packages/auth: Argon2id password hashing, JWT access tokens (jose),
  opaque refresh tokens with rotation, generic error messages (no
  user-enumeration via timing or message differences)
- roles/permissions/role_permissions/user_roles/sessions/audit_logs schema
  (agente.md secoes 142-150); RBAC scope PLATFORM vs TENANT
- withUserContext(): narrow RLS exception so a user can discover their own
  tenant_memberships before a tenant is chosen (login flow)
- userHasPermission()/isPlatformUser(): explicit service-layer RBAC checks
  (roles/permissions tables are not RLS-protected — documented why in
  docs/AUTHENTICATION.md)
- seed: permission catalog, 4 system roles, initial Platform Super Admin
  (password written once to FIRST_LOGIN.txt, 600, outside Git)
- automated end-to-end test: login, RBAC check, refresh rotation, logout

TODO.md

@@ -29,8 +29,17 @@
 - [x] Teste automatizado de isolamento (`pnpm --filter @b2bcall/database run test:isolation`)
 
 ## PHASE 04 — Authentication / RBAC
-- [ ] Login (Argon2id), access/refresh tokens
-- [ ] roles/permissions/user_roles/role_permissions
+- [x] `packages/auth`: hash Argon2id (`@node-rs/argon2`), JWT access token (`jose`),
+      refresh token opaco com rotation
+- [x] Tabelas `roles`, `permissions`, `role_permissions`, `user_roles`, `sessions`, `audit_logs`
+- [x] `login()` / `refreshSession()` / `logout()` / `listUserTenants()` / `setActiveTenant()`
+- [x] `userHasPermission()` (RBAC com scope PLATFORM/TENANT)
+- [x] Seed: catálogo de permissions + roles de sistema + Platform Super Admin inicial
+      (senha em `FIRST_LOGIN.txt`, fora do Git, `mustChangePassword=true`)
+- [x] Teste automatizado (`pnpm --filter @b2bcall/auth run test:auth`)
+- [ ] Camada HTTP (endpoints, rate limit por IP, guards) — depende de `apps/api` existir,
+      ver docs/AUTHENTICATION.md → "O que falta"
+- [ ] Password reset por e-mail — depende de SMTP configurado
 
 ## PHASE 05+ — ver `agente.md` seções 15 em diante (FreeSWITCH, Telefonia, Call Center,
 Predictive Dialer, Recordings, AI, Billing, Frontend, Reports, Security, Tests)