feat: LAD A-Team CIS Compliance Report, React SPA, i18n, report management, explorer UX fixes

- Professional Oracle-format compliance report with RAG remediation from ADB vector store
- React 19 SPA at /app/ (16 pages, TypeScript, Vite, Zustand, i18n pt/en 625 keys)
- Report delete endpoint, embed individual report files into vector store
- Terraform ZIP download (client-side, pure JS)
- Explorer silent polling during start/stop (no flickering)
- HTML report and compliance report sections start minimized
- Token auth fix for compliance report CSV download links

frontend-react/src/api/endpoints/auth.ts

@@ -0,0 +1,31 @@
+import client from '../client';
+
+export interface User {
+  id: string;
+  username: string;
+  role: string;
+  first_name?: string;
+  last_name?: string;
+  email?: string;
+  mfa_enabled?: boolean;
+}
+
+export interface LoginResponse {
+  token?: string;
+  user?: User;
+  mfa_required?: boolean;
+  mfa_setup?: boolean;
+  totp_uri?: string;
+}
+
+export const authApi = {
+  login: (username: string, password: string, totp_code?: string) =>
+    client.post<never, LoginResponse>('/auth/login', { username, password, ...(totp_code && { totp_code }) }),
+
+  logout: () => client.post('/auth/logout'),
+
+  me: () => client.get<never, User>('/users/me'),
+
+  changePassword: (current_password: string, new_password: string) =>
+    client.post('/auth/change-password', { current_password, new_password }),
+};