first commit

backend/app/core/security.py

@@ -0,0 +1,9 @@
+"""Placeholder for authentication & authorization.
+
+In the competition demo we skip real auth. This module reserves the
+extension point so RBAC / JWT can be plugged in later.
+"""
+
+
+async def get_current_user() -> str:
+    return "demo_user"