Password auth, artist folders, timezone fix

Add password-based registration + login alongside existing magic links.
New /register and updated /login with tabs (password default, magic link
as alternative). Bun.password.hash/verify for bcrypt. Auto-login on
register. Landing page CTAs point to /register.

Add projects.artist field for grouping projects by artist in sidebar.
Sidebar shows collapsible artist sections (▸ Anna Berger) with project
counts, "Ohne Zuordnung" for ungrouped projects. Search filters across
artist names. New/edit project forms include artist field.

Fix timezone bug: set postgres connection timezone to UTC so magic link
expiry works correctly in CEST and other non-UTC timezones.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/web/src/routes/+layout.svelte

@@ -3,6 +3,7 @@
   import { page } from '$app/stores';
   import { checkAuth, authLoading } from '$lib/stores/auth.js';
   import ToastContainer from '$lib/components/ui/ToastContainer.svelte';
+  // @ts-ignore — no types shipped for fontsource
   import '@fontsource-variable/inter';
 
   let { children } = $props();
@@ -11,7 +12,9 @@
   const isPublic = $derived(
     $page.url.pathname === '/' ||
       $page.url.pathname === '/login' ||
-      $page.url.pathname.startsWith('/listen/'),
+      $page.url.pathname === '/register' ||
+      $page.url.pathname.startsWith('/listen/') ||
+      $page.url.pathname.startsWith('/auth/'),
   );
 
   onMount(() => {