feat: NovaCPX v1.0.0 initial scaffold

Full hosting control panel with 3 tiers: Admin, Reseller, User.
- install.sh: unattended installer for Ubuntu 20/22/24 + Debian 11/12
- PHP multi-version (7.4/8.1/8.2/8.3), Apache2/nginx choice, MySQL, PostgreSQL
- BIND9 DNS, Postfix+Dovecot mail, ProFTPD, Certbot SSL, UFW, Fail2Ban
- 18-table DB schema with audit log and version tracking
- PHP REST API (auth, system/updates, server stats, service control)
- Admin panel: dark dashboard, service manager, git-based update system
- User panel: usage rings + feature card grid (distinct from cPanel)
- VERSION file: git-tracked; Admin > Updates panel shows/applies git commits

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

panel/api/endpoints/auth.php

@@ -0,0 +1,44 @@
+<?php
+$method = $_SERVER['REQUEST_METHOD'];
+$body   = json_decode(file_get_contents('php://input'), true) ?? [];
+
+match ($action) {
+    'login' => (function() use ($body) {
+        $username = trim($body['username'] ?? '');
+        $password = $body['password'] ?? '';
+        if (!$username || !$password) Response::error('Username and password required');
+        $auth  = Auth::getInstance();
+        $token = $auth->attempt($username, $password);
+        if (!$token) Response::error('Invalid credentials', 401);
+        $user = $auth->user();
+        audit('login', 'auth');
+        Response::success([
+            'token' => $token,
+            'user'  => [
+                'id'       => $user['id'],
+                'username' => $user['username'],
+                'email'    => $user['email'],
+                'role'     => $user['role'],
+                'theme'    => $user['theme'],
+            ],
+        ], 'Login successful');
+    })(),
+
+    'logout' => (function() {
+        Auth::getInstance()->logout();
+        audit('logout', 'auth');
+        Response::success(null, 'Logged out');
+    })(),
+
+    'me' => (function() use ($currentUser) {
+        Response::success([
+            'id'       => $currentUser['uid'],
+            'username' => $currentUser['username'],
+            'email'    => $currentUser['email'],
+            'role'     => $currentUser['role'],
+            'theme'    => $currentUser['theme'],
+        ]);
+    })(),
+
+    default => Response::error('Unknown auth action', 404),
+};