chore: migrate to pnpm workspaces monorepo with Turborepo

- Restructure directories: apps/api, apps/admin, apps/website
- Add root pnpm-workspace.yaml, turbo.json, .prettierrc, .gitignore
- Rename packages to @inkreach/api, @inkreach/admin, @inkreach/website
- Add shared packages: packages/tsconfig, packages/shared-types
- Add pnpm.onlyBuiltDependencies for native builds
- Update docs: README.md, structs.md
- All three projects build successfully

apps/api/src/auth/strategies/jwt.strategy.ts

@@ -0,0 +1,40 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { ConfigService } from '@nestjs/config';
+
+/**
+ * Shape of the JWT we issue.
+ *
+ * `sub` is the user ID as a string (bigints are serialized to strings in JSON).
+ */
+export interface JwtPayload {
+  sub: string;
+  username: string;
+}
+
+@Injectable()
+export class JwtStrategy extends PassportStrategy(Strategy) {
+  constructor(config: ConfigService) {
+    const secret = config.get<string>('JWT_SECRET');
+    if (!secret) {
+      throw new Error('JWT_SECRET is not configured');
+    }
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: secret,
+    });
+  }
+
+  /**
+   * Runs on every authenticated request. The returned object becomes
+   * `request.user` for downstream controllers.
+   */
+  validate(payload: JwtPayload): { id: bigint; username: string } {
+    if (!payload?.sub || !payload.username) {
+      throw new UnauthorizedException('Invalid token payload');
+    }
+    return { id: BigInt(payload.sub), username: payload.username };
+  }
+}