feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

docs/ACCESSIBILITY.md

@@ -0,0 +1,31 @@
+# Accessibility
+
+Target WCAG 2.2 Level AA.
+
+## Required practices
+
+- Semantic HTML.
+- Full keyboard access.
+- Visible focus indicators.
+- Logical focus order.
+- Accessible names for controls.
+- Labels for all form inputs.
+- Required/optional state communicated programmatically and visually.
+- Accessible validation and error messages.
+- No color-only meaning.
+- Sufficient contrast.
+- Responsive layouts.
+- Support browser zoom and text resizing.
+- Accessible dialogs and galleries.
+- Focus management for dynamic UI.
+- Appropriate live-region/status announcements for important asynchronous changes.
+- Meaningful image alt text.
+- Use ARIA only where native semantics are insufficient.
+
+## Testing
+
+Run automated accessibility testing in CI.
+
+Serious accessibility regressions should fail CI.
+
+Automated tests do not replace manual keyboard and assistive-technology review for important workflows.