feat(auth): login JWT en API y las 4 apps

- Modelo Usuario + seed desde lista de vendedores (18 usuarios, bcrypt cost 12)
- POST /api/auth/login + /api/auth/me; middleware Bearer en todo /api
  excepto health, login y webhook Monday; flag AUTH_ENABLED
- Username = nombre completo normalizado (case/acentos insensible),
  password inicial Frasa2026, admin vía ADMIN_PASSWORD
- Apps: LoginScreen + AuthGate (StudioBlank), token en localStorage,
  header Authorization en todas las llamadas, logout en 401
- Tests: api 136, cotizador 71, alta 65, cobranza 71, agente-ia 13, landing 4

apps/alta-clientes/src/components/AuthGate.tsx

@@ -0,0 +1,38 @@
+import { useState, type ReactNode } from 'react'
+import { getSesion, logout, type Sesion } from '../services/auth'
+import LoginScreen from './LoginScreen'
+
+/**
+ * Gate de autenticación: sin sesión solo se ve el login; con sesión se ve la
+ * app con una barra discreta "nombre · rol" y botón "Salir".
+ */
+export default function AuthGate({ children }: { children: ReactNode }) {
+  const [sesion, setSesion] = useState<Sesion | null>(() => getSesion())
+
+  if (!sesion) {
+    return <LoginScreen onLogin={() => setSesion(getSesion())} />
+  }
+
+  return (
+    <div className="min-h-screen bg-white text-neutral-900">
+      <div className="border-b border-neutral-200">
+        <div className="mx-auto flex max-w-6xl items-center justify-between px-4 py-2">
+          <span className="text-xs font-bold uppercase tracking-widest text-neutral-500">
+            {sesion.usuario.nombre} · {sesion.usuario.rol}
+          </span>
+          <button
+            type="button"
+            onClick={() => {
+              logout()
+              setSesion(null)
+            }}
+            className="text-xs font-bold uppercase tracking-widest text-accent transition-colors duration-150 hover:text-accent-hover"
+          >
+            Salir
+          </button>
+        </div>
+      </div>
+      {children}
+    </div>
+  )
+}

apps/alta-clientes/src/components/LoginScreen.tsx

@@ -0,0 +1,88 @@
+import { useState, type FormEvent } from 'react'
+import { login, ErrorLogin, type UsuarioSesion } from '../services/auth'
+
+/** Pantalla de login StudioBlank: marca FRASA, usuario + contraseña, Enter envía */
+export default function LoginScreen({ onLogin }: { onLogin: (usuario: UsuarioSesion) => void }) {
+  const [username, setUsername] = useState('')
+  const [password, setPassword] = useState('')
+  const [error, setError] = useState<string | null>(null)
+  const [cargando, setCargando] = useState(false)
+
+  async function enviar(e: FormEvent) {
+    e.preventDefault()
+    setError(null)
+    setCargando(true)
+    try {
+      onLogin(await login(username, password))
+    } catch (err) {
+      setError(err instanceof ErrorLogin ? err.message : 'Usuario o contraseña incorrectos')
+    } finally {
+      setCargando(false)
+    }
+  }
+
+  return (
+    <div className="flex min-h-screen items-center justify-center bg-white px-4">
+      <div className="w-full max-w-sm">
+        <div className="mb-10 text-center">
+          <p className="text-lg font-bold tracking-widest">FRASA</p>
+          <p className="mt-2 text-xs font-bold uppercase tracking-widest text-neutral-500">
+            Acceso al ecosistema
+          </p>
+        </div>
+        <form onSubmit={enviar} className="space-y-6">
+          <div>
+            <label
+              htmlFor="login-usuario"
+              className="mb-2 block text-xs font-bold uppercase tracking-widest text-neutral-500"
+            >
+              Usuario
+            </label>
+            <input
+              id="login-usuario"
+              type="text"
+              value={username}
+              onChange={(e) => setUsername(e.target.value)}
+              autoComplete="username"
+              autoFocus
+              required
+              className="w-full border border-neutral-300 px-4 py-3 text-sm focus:border-accent focus:outline-none"
+            />
+          </div>
+          <div>
+            <label
+              htmlFor="login-password"
+              className="mb-2 block text-xs font-bold uppercase tracking-widest text-neutral-500"
+            >
+              Contraseña
+            </label>
+            <input
+              id="login-password"
+              type="password"
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              autoComplete="current-password"
+              required
+              className="w-full border border-neutral-300 px-4 py-3 text-sm focus:border-accent focus:outline-none"
+            />
+          </div>
+          {error && (
+            <p
+              role="alert"
+              className="border border-red-700 px-4 py-3 text-xs font-bold uppercase tracking-widest text-red-700"
+            >
+              {error}
+            </p>
+          )}
+          <button
+            type="submit"
+            disabled={cargando}
+            className="w-full bg-accent px-5 py-3 text-xs font-bold uppercase tracking-widest text-white transition-colors duration-150 hover:bg-accent-hover disabled:opacity-50"
+          >
+            {cargando ? 'Entrando…' : 'Entrar'}
+          </button>
+        </form>
+      </div>
+    </div>
+  )
+}