feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

apps/api/tests/domain/product.test.js

@@ -0,0 +1,29 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { createProduct } from '../../src/modules/products/domain/product.js';
+
+test('creates a product with required product identity fields', () => {
+  const product = createProduct({
+    name: ' Charizard ex ',
+    categoryId: 'category-id',
+    sellerId: 'seller-id',
+  });
+
+  assert.deepEqual(product, {
+    name: 'Charizard ex',
+    categoryId: 'category-id',
+    sellerId: 'seller-id',
+  });
+});
+
+test('rejects a product without a name or category', () => {
+  assert.throws(
+    () => createProduct({ name: ' ', categoryId: 'category-id', sellerId: 'seller-id' }),
+    /Product name is required/,
+  );
+  assert.throws(
+    () => createProduct({ name: 'Pikachu', categoryId: '', sellerId: 'seller-id' }),
+    /Category ID is required/,
+  );
+});