feat(docker-watcher): phase 12 - hardening

Blue-green zero-downtime deploys, promote flow validation.
Dual auth: local (bcrypt + JWT) and OAuth2/OIDC (any provider).
Auth middleware, login page, auth settings UI.
Structured logging (slog JSON), config export to YAML.
Graceful shutdown with deploy draining.
Multi-stage Dockerfile and production docker-compose.yml.
Swap phase order: Volumes & Env before UI Polish.

internal/store/store.go

@@ -156,8 +156,30 @@ CREATE TABLE IF NOT EXISTS poll_states (
 	last_polled TEXT NOT NULL DEFAULT (datetime('now'))
 );
 
+CREATE TABLE IF NOT EXISTS users (
+	id            TEXT PRIMARY KEY,
+	username      TEXT NOT NULL UNIQUE,
+	password_hash TEXT NOT NULL DEFAULT '',
+	email         TEXT NOT NULL DEFAULT '',
+	role          TEXT NOT NULL DEFAULT 'viewer',
+	created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+	updated_at    TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS auth_settings (
+	id                  INTEGER PRIMARY KEY CHECK (id = 1),
+	auth_mode           TEXT NOT NULL DEFAULT 'local',
+	oidc_client_id      TEXT NOT NULL DEFAULT '',
+	oidc_client_secret  TEXT NOT NULL DEFAULT '',
+	oidc_issuer_url     TEXT NOT NULL DEFAULT '',
+	oidc_redirect_url   TEXT NOT NULL DEFAULT ''
+);
+
 -- Seed the settings row if it does not exist.
 INSERT OR IGNORE INTO settings (id) VALUES (1);
+
+-- Seed the auth_settings row if it does not exist.
+INSERT OR IGNORE INTO auth_settings (id) VALUES (1);
 `
 
 // now returns the current time formatted for SQLite storage.