feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

database/migrations/0007_listing_image_count.sql

@@ -0,0 +1 @@
+ALTER TABLE "listings" ADD COLUMN "image_count" integer NOT NULL DEFAULT 1;