feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

apps/api/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@pokemon-inventory/api",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "provision:admin": "node src/modules/auth/scripts/provision-initial-admin.js",
+    "start": "node src/app/server.js",
+    "test:application": "node --test tests/application/*.test.js",
+    "test:domain": "node --test tests/domain/*.test.js",
+    "test:http": "node --test tests/http/*.test.js",
+    "test:integration": "node --test --test-concurrency=1 tests/integration/*.test.js"
+  },
+  "dependencies": {
+    "@fastify/cookie": "^11.0.2",
+    "@pokemon-inventory/contracts": "*",
+    "@pokemon-inventory/validation": "*",
+    "dotenv": "^16.6.1",
+    "drizzle-orm": "^0.44.7",
+    "fastify": "^5.6.1",
+    "nodemailer": "^7.0.6",
+    "otpauth": "^9.4.1",
+    "pg": "^8.16.3",
+    "redis": "^5.8.2"
+  }
+}