Add JWT auth with per-user data isolation and account settings.

Users can register, log in, and manage profile/password in a personal account page; server data is scoped by owner across contacts, maps, tags, and import.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/config/settings.py

@@ -72,6 +72,12 @@ DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
 USE_JWT_AUTH = os.environ.get('USE_JWT_AUTH', 'false').lower() in ('1', 'true', 'yes')
 
 if USE_JWT_AUTH:
+    from datetime import timedelta
+
+    SIMPLE_JWT = {
+        'ACCESS_TOKEN_LIFETIME': timedelta(hours=12),
+        'REFRESH_TOKEN_LIFETIME': timedelta(days=7),
+    }
     REST_FRAMEWORK['DEFAULT_AUTHENTICATION_CLASSES'] = [
         'rest_framework_simplejwt.authentication.JWTAuthentication',
     ]