Clerk + FastAPI architecture

Next.js owns auth UX. FastAPI remains the backend authority.

This architecture is documented in docs/frontend/SESSION_AND_ROUTE_PROTECTION.md: Clerk issues the session, the browser sends the bearer token directly to FastAPI, and the Python service verifies workspace-scoped access.