feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

apps/api/src/infrastructure/database/client.js

@@ -0,0 +1,19 @@
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { Pool } from 'pg';
+
+function requiredConnectionString(connectionString) {
+  if (typeof connectionString !== 'string' || connectionString.length === 0) {
+    throw new Error('DATABASE_URL is required.');
+  }
+
+  return connectionString;
+}
+
+export function createDatabase(connectionString = process.env.DATABASE_URL) {
+  const pool = new Pool({ connectionString: requiredConnectionString(connectionString) });
+
+  return {
+    db: drizzle({ client: pool }),
+    close: () => pool.end(),
+  };
+}