feat(07-02): serve login, logout, fetch, and refresh

Wire the user API session loop to the JWT blacklist and a pre-password throttle gate so a logged-out token cannot be fetched again.

Co-authored-by: Cursor <cursoragent@cursor.com>

classes/events.go

@@ -0,0 +1,22 @@
+package classes
+
+import "git.golem15.com/golem15/fonoteka/plugins/golem15/user/models"
+
+// GetApiArrayEvent is the fire-and-collect payload other plugins extend.
+type GetApiArrayEvent struct {
+	User *models.User
+	data map[string]any
+}
+
+// Collected returns the map listeners merge into the user payload.
+func (e *GetApiArrayEvent) Collected() map[string]any {
+	if e.data == nil {
+		e.data = map[string]any{}
+	}
+	return e.data
+}
+
+// RegisterEvent is fired after a user row is created. No listener consumes it yet.
+type RegisterEvent struct {
+	User *models.User
+}