Feature: Authentication Flow Improvements and Authorization Roles

[jbriones1]

Description

• Overhauled how our authentication flow works.
• Grouped our REST API into auth, api, and kiosk.
• Created a new database table that tracks user's roles in our system.
  • Still WIP, need a way to insert these easily.
• Changed environment variables.
• Added support for multiple frontend origins.

Changes

• Overhauled CAS authentication into a browser redirect flow using /auth/login and /auth/validate, along with the entire auth test suite.
• Added validated, allow-listed return URLs with production HTTPS restrictions.
• Added short-lived, database-backed login-attempt tokens to prevent replay attacks.
• Replaced plaintext session IDs in the database with SHA-256 hashes and explicit expiration timestamps.
• Changed logout to POST /auth/logout, returning 204 and deleting the session record and cookie.
• Added /auth/verify for session and role verification through the X-Required-Role header.
• Added admin, exec, and user roles with hierarchical authorization.
• Added roles to /auth/user as a flat list while removing login timestamps from its public response.
• Added auth_redirect and site_user_role tables and updated the user_session schema.
• Introduced an explicit /api router for elections, candidates, nominees, officers, events, honorary members, and images.
• Kept authentication under /auth and kiosk routes under /kiosk
• Removed the obsolete /permission/is_admin endpoint.
• fix TransLink endpoints display twice in the documentation #164: Restricted TransLink endpoints to the authenticated /kiosk/translink/*.
• Replaced FRONTEND_ORIGIN and configurable AUTH_URL with APP_URL, ALLOWED_ORIGINS, and ALLOWED_RETURN_ORIGINS.
• Updated CORS, environment examples, README documentation, and workflow variables.