feat(02-02): auth API endpoints + security hardening + Python 3.9 compat

- backend/api/auth.py: register, login (TOTP+backup), refresh, logout,
  me, change-password; per-account Redis rate limit; HIBP check
- backend/main.py: Origin validation middleware, CSP headers middleware,
  CORS locked to settings.cors_origins, Redis lifespan (app.state.redis),
  admin bootstrap, auth router included, slowapi SlowAPIMiddleware
- backend/services/email.py: already created in Plan 01 (verified exists)
- Python 3.9 compat: fixed match statement in ai/__init__.py,
  str|None union syntax in openai_provider.py, api/documents.py,
  api/topics.py, api/settings.py, services/classifier.py

All 17 tests in test_auth_api.py pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/settings.py

@@ -1,4 +1,6 @@
 import time
+from typing import Optional
+
 from fastapi import APIRouter, HTTPException
 from pydantic import BaseModel
 from services import storage
@@ -9,9 +11,9 @@ router = APIRouter(prefix="/api/settings", tags=["settings"])
 
 
 class SettingsPatch(BaseModel):
-    system_prompt: str | None = None
-    active_provider: str | None = None
-    providers: dict | None = None
+    system_prompt: Optional[str] = None
+    active_provider: Optional[str] = None
+    providers: Optional[dict] = None
 
 
 class TestProviderRequest(BaseModel):