feat(web): add auth and fix deployment checks

src/dotnet/QuantEngine.Infrastructure/Repositories/WorkspaceRepository.cs

@@ -17,6 +17,89 @@ namespace QuantEngine.Infrastructure.Repositories
             _connectionFactory = connectionFactory;
         }
 
+        // Accounts
+        public async Task<IEnumerable<WorkspaceAccount>> GetAccountsAsync()
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            return await conn.QueryAsync<WorkspaceAccount>(@"
+                SELECT ordinal, username as Username, password_hash as PasswordHash, role as Role,
+                       is_active as IsActive, created_at as CreatedAt, updated_at as UpdatedAt
+                FROM quantengine.workspace_account
+                ORDER BY ordinal ASC"
+            );
+        }
+
+        public async Task<WorkspaceAccount?> GetAccountByUsernameAsync(string username)
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            return await conn.QueryFirstOrDefaultAsync<WorkspaceAccount>(@"
+                SELECT ordinal, username as Username, password_hash as PasswordHash, role as Role,
+                       is_active as IsActive, created_at as CreatedAt, updated_at as UpdatedAt
+                FROM quantengine.workspace_account
+                WHERE username = @Username",
+                new { Username = username }
+            );
+        }
+
+        public async Task<bool> UpsertAccountAsync(WorkspaceAccount account)
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            var affected = await conn.ExecuteAsync(@"
+                INSERT INTO quantengine.workspace_account (ordinal, username, password_hash, role, is_active, created_at, updated_at)
+                VALUES (@Ordinal, @Username, @PasswordHash, @Role, @IsActive, @CreatedAt, @UpdatedAt)
+                ON CONFLICT (username) DO UPDATE SET
+                    ordinal = EXCLUDED.ordinal,
+                    password_hash = EXCLUDED.password_hash,
+                    role = EXCLUDED.role,
+                    is_active = EXCLUDED.is_active,
+                    updated_at = EXCLUDED.updated_at",
+                account
+            );
+            return affected > 0;
+        }
+
+        public async Task<WorkspaceSession?> GetSessionByTokenHashAsync(string tokenHash)
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            return await conn.QueryFirstOrDefaultAsync<WorkspaceSession>(@"
+                SELECT session_token_hash as SessionTokenHash, username as Username, role as Role,
+                       created_at as CreatedAt, expires_at as ExpiresAt, revoked_at as RevokedAt
+                FROM quantengine.workspace_session
+                WHERE session_token_hash = @TokenHash",
+                new { TokenHash = tokenHash }
+            );
+        }
+
+        public async Task<bool> UpsertSessionAsync(WorkspaceSession session)
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            var affected = await conn.ExecuteAsync(@"
+                INSERT INTO quantengine.workspace_session
+                    (session_token_hash, username, role, created_at, expires_at, revoked_at)
+                VALUES
+                    (@SessionTokenHash, @Username, @Role, @CreatedAt, @ExpiresAt, @RevokedAt)
+                ON CONFLICT (session_token_hash) DO UPDATE SET
+                    username = EXCLUDED.username,
+                    role = EXCLUDED.role,
+                    expires_at = EXCLUDED.expires_at,
+                    revoked_at = EXCLUDED.revoked_at",
+                session
+            );
+            return affected > 0;
+        }
+
+        public async Task<bool> RevokeSessionAsync(string tokenHash, string revokedAt)
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            var affected = await conn.ExecuteAsync(@"
+                UPDATE quantengine.workspace_session
+                SET revoked_at = @RevokedAt
+                WHERE session_token_hash = @TokenHash",
+                new { TokenHash = tokenHash, RevokedAt = revokedAt }
+            );
+            return affected > 0;
+        }
+
         // Settings
         public async Task<IEnumerable<Setting>> GetSettingsAsync()
         {