Add auth setup project, viewer session check, upload that posts a fixture, FastAPI login spec (skips without E2E_API_*), and repo ROADMAP.md.