feat: wire auth into main app, protect landing page, add create_admin script

scripts/create_admin.py

@@ -0,0 +1,38 @@
+"""
+Create or reset the admin user.
+
+Usage:
+    .venv/bin/python scripts/create_admin.py <username> <password>
+
+Example:
+    .venv/bin/python scripts/create_admin.py admin geheim123
+"""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from app.core.database import SessionLocal, engine, Base
+from app.modules.auth.models import User  # noqa: F401 — registers table
+from app.modules.auth.service import get_user, hash_password
+
+
+def create_admin(username: str, password: str) -> None:
+    Base.metadata.create_all(bind=engine)
+    with SessionLocal() as db:
+        user = get_user(db, username)
+        if user is None:
+            user = User(username=username, full_name="Administrator")
+            db.add(user)
+        user.pw_hash = hash_password(password)
+        user.is_admin = True
+        user.is_active = True
+        db.commit()
+        print(f"Admin user '{username}' created/updated.")
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 3:
+        print(__doc__)
+        sys.exit(1)
+    create_admin(sys.argv[1], sys.argv[2])