Minimal auth v1 (identity for decisions)

## Goal
Attach decisions to real identities (audit realism).

## Depends on
- Decision API (commitment + immutability)

## Acceptance criteria
- [ ] Simple login or API token-based identity
- [ ] Decisions store `decision_maker`
- [ ] UI shows current user
