M1: implement operational core

Demo auth, seed import/reset, dashboard, vehicle/booking list+detail, audit trail. Backend: 19 tests passing, ruff clean. Frontend: React Router shell, typed API client, responsive pages. Verified end-to-end via curl and browser.

backend/tests/test_auth.py

@@ -0,0 +1,20 @@
+def test_unauthenticated_dashboard_is_rejected(client):
+    response = client.get("/api/v1/dashboard")
+    assert response.status_code == 401
+    assert response.json()["error"]["code"] == "401"
+
+
+def test_demo_login_grants_access(ops_client):
+    response = ops_client.get("/api/v1/dashboard")
+    assert response.status_code == 200
+
+
+def test_rental_employee_cannot_reset_demo(employee_client):
+    response = employee_client.post("/api/v1/demo/reset")
+    assert response.status_code == 403
+
+
+def test_operations_manager_can_reset_demo(ops_client):
+    response = ops_client.post("/api/v1/demo/reset")
+    assert response.status_code == 200
+    assert response.json()["counts"]["vehicles"] == 50