feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

apps/api/tests/application/inventory-item-service.test.js

@@ -0,0 +1,49 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { createInventoryItemService } from '../../src/modules/inventory/services/inventory-item-service.js';
+
+function createService({ product, condition }) {
+  return createInventoryItemService({
+    productRepository: { async findById() { return product; } },
+    conditionRepository: { async findById() { return condition; } },
+    inventoryItemRepository: { async create(inventoryItem) { return inventoryItem; } },
+  });
+}
+
+test('creates an inventory item when its condition belongs to the product category', async () => {
+  const service = createService({
+    product: { id: 'product-id', sellerId: 'seller-id', categoryId: 'cards' },
+    condition: { id: 'condition-id', categoryId: 'cards' },
+  });
+
+  const inventoryItem = await service.create({
+    productId: 'product-id',
+    conditionId: 'condition-id',
+    sellerId: 'seller-id',
+    notes: ' Near mint ',
+  });
+
+  assert.deepEqual(inventoryItem, {
+    productId: 'product-id',
+    conditionId: 'condition-id',
+    notes: 'Near mint',
+  });
+});
+
+test('rejects conditions from another category', async () => {
+  const service = createService({
+    product: { id: 'product-id', sellerId: 'seller-id', categoryId: 'cards' },
+    condition: { id: 'condition-id', categoryId: 'merchandise' },
+  });
+
+  await assert.rejects(
+    () =>
+      service.create({
+        productId: 'product-id',
+        conditionId: 'condition-id',
+        sellerId: 'seller-id',
+      }),
+    (error) => error.code === 'CONDITION_CATEGORY_MISMATCH',
+  );
+});