feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

database/migrations/0004_password_reset_tokens.sql

@@ -0,0 +1,10 @@
+CREATE TABLE "password_reset_tokens" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "user_id" uuid NOT NULL REFERENCES "users"("id"),
+  "token_hash" text NOT NULL,
+  "expires_at" timestamp with time zone NOT NULL,
+  "used_at" timestamp with time zone,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  CONSTRAINT "password_reset_tokens_token_hash_unique" UNIQUE("token_hash")
+);
+CREATE INDEX "password_reset_tokens_user_id_index" ON "password_reset_tokens" ("user_id");