feat: authentication with local accounts, sessions, CSRF, RBAC, and OIDC PKCE (phase 3)

- argon2id (t=3, m=64MiB, p=2) PHC hashing honoring embedded params
- token-bucket rate limiting (10/15min per IP+email) on login/register
- opaque 32B session tokens in Mongo, 30-day sliding expiry, logout-all
- CSRF double-submit cookie/header on authenticated mutations
- bootstrap admin from env with forced first-login password change
- requireAuth/requireRole middleware with disabled-account enforcement
- OIDC code flow with PKCE: lazy discovery, account linking only on
  verified email, auto-created developer accounts
- unit tests (RBAC matrix, CSRF, password, rate limiter) + integration
  suite covering the full auth matrix incl. an in-test fake IdP

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/auth/ratelimit_test.go

@@ -0,0 +1,62 @@
+package auth
+
+import (
+	"testing"
+	"time"
+)
+
+func TestRateLimiterExhaustionAndRefill(t *testing.T) {
+	rl := NewRateLimiter(10, 15*time.Minute)
+	now := time.Date(2026, 6, 12, 12, 0, 0, 0, time.UTC)
+	rl.now = func() time.Time { return now }
+
+	for i := 0; i < 10; i++ {
+		if !rl.Allow("ip|a@b.c") {
+			t.Fatalf("attempt %d should be allowed", i+1)
+		}
+	}
+	if rl.Allow("ip|a@b.c") {
+		t.Fatal("11th attempt must be blocked")
+	}
+
+	// Other keys are unaffected.
+	if !rl.Allow("ip|other@b.c") {
+		t.Fatal("different key must have its own bucket")
+	}
+
+	// After 1.5 minutes one token has refilled (10 per 15 min).
+	now = now.Add(90 * time.Second)
+	if !rl.Allow("ip|a@b.c") {
+		t.Fatal("one attempt should have refilled")
+	}
+	if rl.Allow("ip|a@b.c") {
+		t.Fatal("bucket must be empty again")
+	}
+
+	// A full window refills completely, capped at capacity.
+	now = now.Add(time.Hour)
+	for i := 0; i < 10; i++ {
+		if !rl.Allow("ip|a@b.c") {
+			t.Fatalf("post-refill attempt %d should be allowed", i+1)
+		}
+	}
+	if rl.Allow("ip|a@b.c") {
+		t.Fatal("refill must cap at capacity")
+	}
+}
+
+func TestRateLimiterGC(t *testing.T) {
+	rl := NewRateLimiter(10, 15*time.Minute)
+	now := time.Date(2026, 6, 12, 12, 0, 0, 0, time.UTC)
+	rl.now = func() time.Time { return now }
+
+	rl.Allow("stale")
+	now = now.Add(16 * time.Minute)
+	rl.Allow("fresh") // triggers gc
+	rl.mu.Lock()
+	_, staleExists := rl.buckets["stale"]
+	rl.mu.Unlock()
+	if staleExists {
+		t.Fatal("idle bucket should have been swept")
+	}
+}