feat: authentication with local accounts, sessions, CSRF, RBAC, and OIDC PKCE (phase 3)

- argon2id (t=3, m=64MiB, p=2) PHC hashing honoring embedded params
- token-bucket rate limiting (10/15min per IP+email) on login/register
- opaque 32B session tokens in Mongo, 30-day sliding expiry, logout-all
- CSRF double-submit cookie/header on authenticated mutations
- bootstrap admin from env with forced first-login password change
- requireAuth/requireRole middleware with disabled-account enforcement
- OIDC code flow with PKCE: lazy discovery, account linking only on
  verified email, auto-created developer accounts
- unit tests (RBAC matrix, CSRF, password, rate limiter) + integration
  suite covering the full auth matrix incl. an in-test fake IdP

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/domain/session.go

@@ -0,0 +1,18 @@
+package domain
+
+import "time"
+
+// Session is an opaque server-side session (§4.8). The random token is the
+// document id; the Mongo TTL index on expiresAt reaps stale rows.
+type Session struct {
+	Token       string    `bson:"_id"`
+	UserID      string    `bson:"userId"`
+	CreatedAt   time.Time `bson:"createdAt"`
+	ExpiresAt   time.Time `bson:"expiresAt"`
+	RefreshedAt time.Time `bson:"refreshedAt"`
+	IP          string    `bson:"ip"`
+	UA          string    `bson:"ua"`
+}
+
+// SessionTTL is the sliding session lifetime (§7).
+const SessionTTL = 30 * 24 * time.Hour