Security Agent pentest demo app

Login endpoint: POST /app-api/login with JSON {username, password}.

Authenticated endpoint: GET /app-api/api/v1/me with header Authorization: Bearer <token>.