feat: backend MVP (auth/rbac, catalog, orders, fulfillment, invoices) + specs + scaffolds

openspec/changes/foundation-auth/tasks.md

@@ -0,0 +1,20 @@
+# Tasks: foundation-auth
+
+## 1. Backend skeleton
+- [x] Cargo workspace, vmall-api crate (axum, sqlx, redis, tower-http)
+- [x] Config from env (DATABASE_URL, REDIS_URL, JWT_SECRET, PORT)
+- [x] Health + readiness endpoints (db/redis checked)
+- [x] sqlx migrate on boot; 0001_init migration
+
+## 2. Identity schema
+- [ ] Migration: users, shops tables; role enum
+- [ ] Seed platform admin (admin@vmall.local / admin1234)
+
+## 3. Auth API
+- [ ] POST /api/auth/register (customer role)
+- [ ] POST /api/auth/login → JWT + user
+- [ ] GET /api/auth/me (Bearer)
+- [ ] Auth extractor + require_role guard
+
+## 4. Tests
+- [ ] cargo test: register/login/me happy path, wrong password, role guard denies customer on admin route