feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

docs/PRODUCT.md

@@ -0,0 +1,36 @@
+# Product Definition
+
+## Purpose
+
+Provide a personal catalog for Pokémon products the seller owns, allowing the seller to maintain inventory, understand market pricing, publish asking prices, and record completed external sales.
+
+## Primary users
+
+### Public visitor
+Can search and browse available inventory, inspect item details, view calculated market value and asking price, and contact the seller.
+
+### Admin/seller
+Can manage products, physical inventory, listings, images, pricing, acquisitions, sales, settings, and history.
+
+MVP has one seller/admin. The model is multi-seller ready.
+
+## Non-goals
+
+The application does not provide:
+- shopping cart
+- checkout
+- payment processing
+- shipping fulfillment
+- customer accounts
+- order management
+- in-app e-commerce transactions
+
+## Product principles
+
+1. Inventory accuracy over convenience.
+2. Preserve history.
+3. Keep private seller data private.
+4. Automate repetitive pricing work without hiding its provenance.
+5. Allow unusual products that have no provider match.
+6. Prefer reusable domain services over duplicated behavior.
+7. Accessibility is a product requirement, not a later enhancement.