Phase 2 session stability: refresh queue, Bearer fallback, proactive refresh

Update auth-fix-plan: mark Phase 1 tasks completed

Phase 1 auth security hotfixes: cookie-based session, bearer checks, router guard sync ...

- Remove access_token from OAuth callback URL (token leak fix)
- Add sanitizeReturnTo() to prevent open redirect on login/callback
- Add Bearer token expiration check in resolve_user_by_bearer()
- Add user status check in load_user_by_id() (block inactive/banned)
- Cache authStore.init() promise to prevent race condition
- Await auth init in router beforeEach guard
- Remove URL token parsing from main.js and LoginPage
- Remove hasTokenInUrl workaround from client.js 401 handler

Update docs: guest is explicit authenticated role, no anonymous access

Phase 0: gnexus-auth integration infrastructure ...

- Add gnexus/auth-client via Composer vcs
- Thin PSR-18/17 cURL adapter (zero extra deps)
- SessionStateStore, SessionPkceStore, DbTokenStore
- AuthService wrapper: login URL, callback, logout, refresh, me
- UserResolver + PermissionResolver
- AuthController (login, callback, logout, me, refresh)
- WebhookController + WebhookRouter + event handlers
- AuthControllerTrait for endpoint protection
- Migration: 9 tables (users, roles, permissions, overrides, groups, members, group_perms, sessions, audit) + seed data
- Remove old Example_AuthController
- Add GAUTH_* env variables to config and .env.example