feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

.local/project-ports.json

@@ -0,0 +1,27 @@
+{
+  "version": 1,
+  "projectName": "pokemon-inventory",
+  "projectPath": "/Users/fragginwagon/Developer/Source Code/pokemon/pokemon-inventory",
+  "updatedAt": "2026-09-07T15:05:39.264Z",
+  "lastSeenAt": "2026-09-07T15:05:39.264Z",
+  "ports": [
+    {
+      "service": "api",
+      "protocol": "tcp",
+      "port": 3000,
+      "notes": ""
+    },
+    {
+      "service": "postgres",
+      "protocol": "tcp",
+      "port": 5433,
+      "notes": ""
+    },
+    {
+      "service": "redis",
+      "protocol": "tcp",
+      "port": 6380,
+      "notes": ""
+    }
+  ]
+}