feat: 가계부·게시판 백엔드 API 구현

- com.sb.web 패키지로 재구성: account / auth / board / user / admin / common
- 가계부(account): 내역(필터), 계좌·순자산, 예산, 분류, 정기 거래, 투자 포트폴리오
  (종목·매매 이력, 이동평균 평단·실현/평가손익)
- MyBatis + MariaDB + Redis 세션, BCrypt
- 스키마 자동 초기화(db/*.sql, 멱등), 사용자별 데이터 격리(member_id)
- 문서: docs/BACKEND.md, .env.example

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/java/com/sb/web/auth/service/AuthService.java

@@ -0,0 +1,102 @@
+package com.sb.web.auth.service;
+
+import com.sb.web.auth.domain.Member;
+import com.sb.web.auth.dto.LoginRequest;
+import com.sb.web.auth.dto.LoginResponse;
+import com.sb.web.auth.dto.MemberResponse;
+import com.sb.web.auth.dto.SessionUser;
+import com.sb.web.auth.dto.SignupRequest;
+import com.sb.web.common.exception.ApiException;
+import com.sb.web.auth.mapper.MemberMapper;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.http.HttpStatus;
+import org.springframework.data.redis.core.RedisTemplate;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.time.Duration;
+import java.util.UUID;
+
+/**
+ * 인증 서비스.
+ * - 회원가입: BCrypt 해시 저장
+ * - 로그인:   비밀번호 검증 후 세션 토큰 발급 → Redis 저장
+ * - 세션:     Redis 에서 토큰으로 조회(슬라이딩 만료), 로그아웃 시 삭제
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class AuthService {
+
+    private final MemberMapper memberMapper;
+    private final PasswordEncoder passwordEncoder;
+    private final RedisTemplate<String, Object> redisTemplate;
+
+    private static final String SESSION_PREFIX = "session:";
+    private static final Duration SESSION_TTL = Duration.ofMinutes(60);
+
+    @Transactional
+    public MemberResponse signup(SignupRequest req) {
+        if (memberMapper.countByLoginId(req.getLoginId()) > 0) {
+            throw new ApiException(HttpStatus.CONFLICT, "이미 사용 중인 아이디입니다.");
+        }
+        Member member = Member.builder()
+                .loginId(req.getLoginId())
+                .password(passwordEncoder.encode(req.getPassword()))
+                .name(req.getName())
+                .email(req.getEmail())
+                .provider("LOCAL")
+                .role("USER")
+                .status("ACTIVE")
+                .build();
+        memberMapper.insert(member);
+        log.info("[signup] new member: {}", member.getLoginId());
+        return MemberResponse.from(member);
+    }
+
+    public LoginResponse login(LoginRequest req) {
+        Member member = memberMapper.findByLoginId(req.getLoginId());
+        if (member == null
+                || member.getPassword() == null
+                || !passwordEncoder.matches(req.getPassword(), member.getPassword())) {
+            throw new ApiException(HttpStatus.UNAUTHORIZED, "아이디 또는 비밀번호가 올바르지 않습니다.");
+        }
+        if (!"ACTIVE".equals(member.getStatus())) {
+            throw new ApiException(HttpStatus.FORBIDDEN, "사용할 수 없는 계정입니다.");
+        }
+
+        String token = UUID.randomUUID().toString().replace("-", "");
+        redisTemplate.opsForValue().set(SESSION_PREFIX + token, SessionUser.from(member), SESSION_TTL);
+        log.info("[login] {} (token issued)", member.getLoginId());
+
+        return LoginResponse.builder()
+                .token(token)
+                .expiresInSeconds(SESSION_TTL.getSeconds())
+                .member(MemberResponse.from(member))
+                .build();
+    }
+
+    /**
+     * 토큰으로 세션을 조회하고, 유효하면 TTL 을 갱신(슬라이딩 만료)한다.
+     */
+    public SessionUser getSession(String token) {
+        if (token == null || token.isBlank()) {
+            return null;
+        }
+        String key = SESSION_PREFIX + token;
+        Object cached = redisTemplate.opsForValue().get(key);
+        if (cached instanceof SessionUser user) {
+            redisTemplate.expire(key, SESSION_TTL);
+            return user;
+        }
+        return null;
+    }
+
+    public void logout(String token) {
+        if (token != null && !token.isBlank()) {
+            redisTemplate.delete(SESSION_PREFIX + token);
+        }
+    }
+}