Tests: Add coverage for user, auth, RBAC

[sugan0tech]

Summary\n- Add tests covering user model/store, authentication flows, middleware, and RBAC.\n\nScope\n- Unit: password hashing/verification, JWT utilities, middleware decision logic (cookie vs bearer).\n- Integration (API-level): login success/failure, me, protected route access by role.\n\nReferences\n- Epic: #23\n- Middleware and handlers introduced in prior sub-issues.\n\nAcceptance Criteria\n- Tests run via go test ./... and pass locally.\n- Coverage for happy-path and common failure cases (401, 403).