Added Authentication System

Up until now, the dashboard and all API endpoints were completely open to anyone on the network — a serious problem for a system that controls cameras, smart devices, and even has Remote PC Control capabilities.
I implemented a single-admin authentication layer using Flask sessions and password hashing (werkzeug), gating access behind a login page.
Key changes:

• Added a /login route with session-based authentication
• Passwords are hashed (never stored in plain text) using pbkdf2:sha256
• Wrapped every sensitive route with a @login_required decorator — dashboard, device control APIs, camera toggle, and system/remote-PC endpoints
• API routes return a clean 401 Unauthorized instead of redirecting, so the frontend can handle it gracefully
• Sessions auto-expire, requiring re-login after a set period

This closes the biggest security gap in the project — previously, anyone with access to the local network or Tailscale IP could control devices or the PC without any barrier. Now, all of that is locked behind credentials only I know.
Next steps: Rule engine for automations (trigger-based actions), followed by energy monitoring for Tapo smart plugs.