feat(auth): add session-based login/logout with bcrypt hashing, seed default admin, templates and navbar updates; add auth middleware; pin SQLAlchemy 1.4.x for Py3.13; update TODOs

TODO.md

@@ -6,20 +6,20 @@ Refer to `del.plan.md` for context. Check off items as they’re completed.
 - [ ] Create requirements.txt with minimal deps
 - [ ] Copy delphi-logo.webp into static/logo/
 - [ ] Set up SQLAlchemy Base and engine/session helpers
-- [ ] Add User model with username and password_hash
+- [x] Add User model with username and password_hash
 - [ ] Add Client model (rolodex_id and core fields)
 - [ ] Add Phone model with FK to Client
 - [ ] Add Case model (file_no unique, FK to Client)
 - [ ] Add Transaction model with FK to Case
 - [ ] Add Document model with FK to Case
 - [ ] Add Payment model with FK to Case
-- [ ] Create tables and seed default admin user
-- [ ] Create FastAPI app with DB session dependency
-- [ ] Add SessionMiddleware with SECRET_KEY from env
-- [ ] Configure Jinja2 templates and mount static files
-- [ ] Create base.html with Bootstrap 5 CDN and nav
-- [ ] Implement login form, POST handler, and logout
-- [ ] Create login.html form
+- [x] Create tables and seed default admin user
+- [x] Create FastAPI app with DB session dependency
+- [x] Add SessionMiddleware with SECRET_KEY from env
+- [x] Configure Jinja2 templates and mount static files
+- [x] Create base.html with Bootstrap 5 CDN and nav
+- [x] Implement login form, POST handler, and logout
+- [x] Create login.html form
 - [ ] Implement dashboard route listing cases
 - [ ] Add simple search by file_no/name/keyword
 - [ ] Create dashboard.html with table and search box