Implement auth, persistence, typed responses, and injectable RNG

Auth: JWT tokens (sb-auth) with argon2 password hashing, login/register
endpoints, Bearer token middleware protecting all routes except auth.
Authorization checks ensure users can only access their own characters.

Persistence: SQLite via rusqlite (sb-db) with write-through on all
mutations. Optional via SB_DB_PATH env var; falls back to in-memory.

Typed responses: ~20 response DTOs in sb-shared replacing ad-hoc JSON.

Combat: Injectable RNG via &mut impl Rng for deterministic tests.

Clean Architecture: Combat types and response DTOs in sb-shared; domain
services in sb-core; auth in sb-auth; persistence in sb-db.

crates/sb-core/src/spells.rs

@@ -0,0 +1,74 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SpellDef {
+    pub id: String,
+    pub code: String,
+    pub name: String,
+    pub caster_class: String,
+    pub spell_level: i32,
+    pub spell_points: i32,
+    pub range: String,
+    pub duration: String,
+    pub description: String,
+    pub combat_effect: String,
+    pub combat_damage_min: i32,
+    pub combat_damage_max: i32,
+    pub heal_min: i32,
+    pub heal_max: i32,
+}
+
+const SPELLS_JSON: &str =
+    include_str!("../../../../skara-brae-common/data/spells/spells.json");
+
+pub fn load_spells() -> Vec<SpellDef> {
+    serde_json::from_str(SPELLS_JSON).expect("failed to parse spells.json")
+}
+
+pub fn class_for_spells(class: &str) -> &str {
+    if class == "mage" { "magician" } else { class }
+}
+
+pub fn spells_for_class(class: &str, spell_level: i32) -> Vec<&'static SpellDef> {
+    let spell_class = class_for_spells(class);
+    ALL_SPELLS.iter().filter(|s| {
+        s.caster_class == spell_class && s.spell_level <= spell_level
+    }).collect()
+}
+
+pub fn find_spell(id: &str) -> Option<&'static SpellDef> {
+    ALL_SPELLS.iter().find(|s| s.id == id)
+}
+
+pub fn spell_learn_cost(spell_level: i32) -> i32 {
+    match spell_level {
+        1 => 0,
+        2 => 1000,
+        3 => 2000,
+        4 => 4000,
+        5 => 7000,
+        6 => 10000,
+        7 => 20000,
+        _ => 999999,
+    }
+}
+
+pub fn max_spell_points(class: &str, level: i32) -> i32 {
+    let spell_class = class_for_spells(class);
+    let spell_level = match spell_class {
+        "conjurer" | "magician" | "sorcerer" | "wizard" => (level / 3) + 1,
+        _ => 0,
+    };
+    spell_level * 10
+}
+
+pub fn is_caster_class(class: &str) -> bool {
+    matches!(class_for_spells(class), "conjurer" | "magician" | "sorcerer" | "wizard")
+}
+
+pub fn caster_classes() -> &'static [&'static str] {
+    &["conjurer", "magician", "sorcerer", "wizard"]
+}
+
+use std::sync::LazyLock;
+static ALL_SPELLS: LazyLock<Vec<SpellDef>> = LazyLock::new(load_spells);