feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

database/migrations/0003_security_audit_events.sql

@@ -0,0 +1,11 @@
+CREATE TABLE "security_audit_events" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "user_id" uuid REFERENCES "users"("id"),
+  "event" text NOT NULL,
+  "ip_address" text,
+  "user_agent" text,
+  "metadata" jsonb DEFAULT '{}'::jsonb NOT NULL,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+CREATE INDEX "security_audit_events_user_id_index" ON "security_audit_events" ("user_id");
+CREATE INDEX "security_audit_events_event_created_at_index" ON "security_audit_events" ("event", "created_at");