Add URL shortener cookie auth endpoints

[codeforester]

Summary

• Add cookie-backed signup, login, and logout HTTP endpoints for the URL shortener.
• Add session lookup/touch support and app-layer CurrentUser resolution for future authenticated routes.
• Extend OpenAPI and Hurl API smoke tests for the auth flow.

Validation

• tests/validate.sh
• git diff --check
• git diff --cached --check
• ruby -e 'require "yaml"; YAML.load_file("services/url-shortener/openapi.yaml")'
• GOCACHE=/private/tmp/banyanlabs-go-cache CGO_ENABLED=0 go test ./... -count=1
• GOCACHE=/private/tmp/banyanlabs-go-cache CGO_ENABLED=0 go build ./...
• GOCACHE=/private/tmp/banyanlabs-go-cache CGO_ENABLED=0 go vet ./...
• tests/api/run.sh

Note: mise run test was not used as branch evidence because this temporary worktree's .mise.toml is not trusted by mise; the equivalent underlying commands above were run directly from this worktree.

Fixes #58
References #27