feat: implement v2 3-tier architecture (mcpctl → mcplocal → mcpd)

- Rename local-proxy to mcplocal with HTTP server, LLM pipeline, mcpd discovery
- Add LLM pre-processing: token estimation, filter cache, metrics, Gemini CLI + DeepSeek providers
- Add mcpd auth (login/logout) and MCP proxy endpoints
- Update CLI: dual URLs (mcplocalUrl/mcpdUrl), auth commands, --direct flag
- Add tiered health monitoring, shell completions, e2e integration tests
- 57 test files, 597 tests passing

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/mcpd/src/services/auth.service.ts

@@ -0,0 +1,66 @@
+import { randomUUID } from 'node:crypto';
+import type { PrismaClient } from '@prisma/client';
+import bcrypt from 'bcrypt';
+
+/** 30 days in milliseconds */
+const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+
+export interface LoginResult {
+  token: string;
+  expiresAt: Date;
+  user: { id: string; email: string; role: string };
+}
+
+export class AuthenticationError extends Error {
+  readonly statusCode = 401;
+  constructor(message: string) {
+    super(message);
+    this.name = 'AuthenticationError';
+  }
+}
+
+export class AuthService {
+  constructor(private readonly prisma: PrismaClient) {}
+
+  async login(email: string, password: string): Promise<LoginResult> {
+    const user = await this.prisma.user.findUnique({ where: { email } });
+    if (user === null) {
+      throw new AuthenticationError('Invalid email or password');
+    }
+
+    const valid = await bcrypt.compare(password, user.passwordHash);
+    if (!valid) {
+      throw new AuthenticationError('Invalid email or password');
+    }
+
+    const token = randomUUID();
+    const expiresAt = new Date(Date.now() + SESSION_TTL_MS);
+
+    await this.prisma.session.create({
+      data: {
+        token,
+        userId: user.id,
+        expiresAt,
+      },
+    });
+
+    return {
+      token,
+      expiresAt,
+      user: { id: user.id, email: user.email, role: user.role },
+    };
+  }
+
+  async logout(token: string): Promise<void> {
+    // Delete the session by token; ignore if already deleted
+    await this.prisma.session.deleteMany({ where: { token } });
+  }
+
+  async findSession(token: string): Promise<{ userId: string; expiresAt: Date } | null> {
+    const session = await this.prisma.session.findUnique({ where: { token } });
+    if (session === null) {
+      return null;
+    }
+    return { userId: session.userId, expiresAt: session.expiresAt };
+  }
+}