feat(auth): protect aggregate console with password login

apps/api/src/control-plane.ts

@@ -29,6 +29,8 @@ import { registerJobRoutes } from './interface/http/job-routes.js';
 import { AuditQueryService } from './application/audit/audit-query-service.js';
 import { registerAuditRoutes } from './interface/http/audit-routes.js';
 import { InstanceResourceService } from './application/resources/instance-resource-service.js';
+import { ConsoleAuthService } from './application/auth/console-auth-service.js';
+import { registerConsoleAuth } from './interface/http/console-auth-routes.js';
 import { InstanceMessageService } from './application/messages/instance-message-service.js';
 
 export interface SafeControlPlaneUpstream extends ConnectionTransport {
@@ -93,9 +95,14 @@ export function buildControlPlaneApp(options: ControlPlaneOptions): ControlPlane
     ...(options.now ? { now: options.now } : {}),
   });
   secureExecution.reconcileInterruptedJobs();
+  const auth = new ConsoleAuthService({
+    db: options.db,
+    ...(options.now ? { now: options.now } : {}),
+  });
   const app = buildApp({
     ...options.app,
     registerRoutes: (app) => {
+      registerConsoleAuth(app, auth);
       registerInstanceRoutes(app, {
         instances,
         connections,