feat(v1.1.8): app_users table + repo (migration 0026)

Per-app end-user table for the v1.1.8 users::* SDK. Distinct from
admin_users (control-plane operators) — same Argon2id password hash
shape but everything else (uniqueness scope, ownership, lifecycle)
independent.

- Uniqueness on (app_id, lower(email)) — case-insensitive within an
  app; same email may exist across two apps.
- AppUserRepository trait + Postgres impl; every method takes app_id
  explicitly so cross-app reads are unmistakable at the call site
  (matches v1.1.3 cross-app discipline).
- Public AppUserRow never includes the password hash; the credentials
  shape is its own struct returned only by the login lookup.
- Cursor-based list keyed on (created_at, id).
- Reserved a timing-flat dummy Argon2id PHC constant in auth.rs for
  the upcoming login path so the bad-email and good-email branches
  share wall-clock cost.
- Added AppUserId + InvitationId id types in shared::ids.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/shared/src/ids.rs

@@ -54,3 +54,5 @@ id_type!(AdminUserId);
 id_type!(AppId);
 id_type!(ApiKeyId);
 id_type!(TriggerId);
+id_type!(AppUserId);
+id_type!(InvitationId);

crates/shared/src/lib.rs

@@ -51,7 +51,10 @@ pub use files::{
     FilesListPage, FilesService, NewFile, NoopFilesService,
 };
 pub use http::{HttpError, HttpRequest, HttpResponse, HttpService, NoopHttpService};
-pub use ids::{AdminUserId, ApiKeyId, AppId, ExecutionId, RequestId, ScriptId, TriggerId};
+pub use ids::{
+    AdminUserId, ApiKeyId, AppId, AppUserId, ExecutionId, InvitationId, RequestId, ScriptId,
+    TriggerId,
+};
 pub use inbox::{
     InboxDeliveryOutcome, InboxFailureKind, InboxResolver, InboxResult, NoopInboxResolver,
 };