Problem: there is no real user/account system — the dashboard and every API route are open.
Scope: POST /api/auth/signup creating a USER#{id} item (email, hashed password, name, createdAt, emailVerified=false). Email uniqueness via a GSI (EMAIL#{email}). Return a session on success.
Done when: a new account is created + persisted, duplicate email is rejected, and the user is logged in (see session issue).