refactor: centralize auth system across all modules

All modules now use the main IAM JWT (ACCESS_TOKEN_SECRET) for authentication,
removing three separate auth systems (hackathon Supabase, hackathon JWT, QR JWT).

Changes:
- hackathon: replace HackathonJwtService with decode_access_token() from imphnen-libs
  - remove entire src/auth/ (Supabase signup/login/GitHub/forgot-reset)
  - remove common/hackathon_jwt.rs, common/supabase_client.rs
  - remove Supabase from HackathonConfig (JWT, GitHub OAuth, Supabase anon/service keys)
  - replace Supabase Storage with MinioService from imphnen-libs
  - all route jwt params removed; hackathon_router takes MinioService instead
- qr: replace QrJwtService with decode_access_token() from imphnen-libs
  - remove entire src/auth/ (register/login/Google OAuth/refresh)
  - remove common/qr_jwt.rs, src/config.rs
  - qr_auth_middleware now lazy-upserts users into QR DB on first access
  - qr_router(pool) — no config needed
- gateway: create MinioService once and pass to hackathon_router; qr_router simplified

Users now register/login via /v1/auth/* and use the same JWT for all endpoints.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Cargo.lock

@@ -434,19 +434,6 @@ version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55248b47b0caf0546f7988906588779981c43bb1bc9d0c44087278f80cdb44ba"
 
-[[package]]
-name = "bcrypt"
-version = "0.15.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e65938ed058ef47d92cf8b346cc76ef48984572ade631927e9937b5ffc7662c7"
-dependencies = [
- "base64",
- "blowfish",
- "getrandom 0.2.16",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "bigdecimal"
 version = "0.4.9"
@@ -515,16 +502,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "blowfish"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
-dependencies = [
- "byteorder",
- "cipher",
-]
-
 [[package]]
 name = "borsh"
 version = "1.5.7"
@@ -660,16 +637,6 @@ dependencies = [
  "stacker",
 ]
 
-[[package]]
-name = "cipher"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
-dependencies = [
- "crypto-common",
- "inout",
-]
-
 [[package]]
 name = "color_quant"
 version = "1.1.0"
@@ -1942,12 +1909,10 @@ version = "0.2.0"
 dependencies = [
  "async-trait",
  "axum",
- "axum-extra",
  "base64",
  "chrono",
  "imphnen-libs",
  "imphnen-utils",
- "jsonwebtoken",
  "lettre",
  "reqwest",
  "sea-orm",
@@ -2082,15 +2047,11 @@ version = "0.2.0"
 dependencies = [
  "async-trait",
  "axum",
- "axum-extra",
- "bcrypt",
  "chrono",
  "image",
+ "imphnen-libs",
  "imphnen-utils",
- "jsonwebtoken",
- "oauth2",
  "qrcode",
- "reqwest",
  "serde",
  "serde_json",
  "sqlx",
@@ -2154,15 +2115,6 @@ dependencies = [
  "syn 2.0.111",
 ]
 
-[[package]]
-name = "inout"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "interpolate_name"
 version = "0.2.4"