Implement Auth.js with GitHub OAuth

## Summary
Auth is planned but not implemented — no `users` table, no auth middleware, no login routes.

## Tasks
- [ ] Add `users` table and `decks.user_id` foreign key
- [ ] Auth.js in `apps/web` with GitHub provider
- [ ] JWT or session validation middleware in `apps/api`
- [ ] Scope deck CRUD to authenticated user
- [ ] Document `AUTH_*` env vars in `.env.example`

## Files
- `apps/api/src/db/schema.ts`
- `apps/web/app/`
- `.env.example`
- `implementation_plan.md` (reference)

Start with implementation_plan.md, then inspect apps/api/src/db/schema.ts, apps/web/app/, and .env.example to understand the planned authentication boundaries. Confirm how API CRUD routes and deck ownership are currently exposed before implementing the checklist. Done means GitHub sign-in works, authenticated users are validated and limited to their decks, the schema supports ownership, and AUTH_* variables are documented.

由索引模型根據 Issue 內容生成。