feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

docs/SECURITY.md

@@ -0,0 +1,95 @@
+# Security
+
+## Authentication
+
+MVP:
+- email/password
+- MFA using TOTP or passkey-capable architecture
+- password recovery
+- remember-me option
+- configurable session expiry
+- active session/device management
+- revoke one or all sessions
+
+Use secure server-side sessions with:
+- HttpOnly
+- Secure in production
+- appropriate SameSite policy
+
+Never store auth tokens in localStorage.
+
+## Authorization
+
+MVP has Admin role.
+
+Design authorization so future roles can be added without rewriting domain logic.
+
+All authorization is enforced server-side.
+
+## CSRF
+
+Implement an appropriate CSRF defense for cookie-based authentication.
+
+## Input and API security
+
+- Validate all inputs.
+- Parameterize database queries through Drizzle.
+- Allowlist sort fields.
+- Apply pagination.
+- Rate-limit sensitive/auth endpoints.
+- Use security headers.
+- Do not leak private fields through serialization.
+
+## Upload security
+
+- Validate MIME type and file signatures where practical.
+- Limit size and dimensions.
+- Limit image count.
+- Process in controlled jobs.
+- Treat filenames as untrusted.
+- Do not execute uploaded content.
+
+## Sessions
+
+Suggested fields:
+`id, user_id, session_token_hash, created_at, expires_at, last_activity_at, ip_address, user_agent, revoked_at`
+
+## MFA
+
+Suggested fields:
+`id, user_id, type, secret_reference, name, is_enabled, created_at, last_used_at`
+
+Secrets must be stored using appropriate secret protection; do not expose raw MFA secrets in logs.
+
+## Security audit log
+
+Separate from inventory activity.
+
+Events include:
+- LOGIN_SUCCESS
+- LOGIN_FAILURE
+- PASSWORD_RESET
+- MFA_ENROLLED
+- MFA_FAILURE
+- SESSION_CREATED
+- SESSION_REVOKED
+- ACCOUNT_UPDATED
+
+## Secrets
+
+Credentials, API keys, database URLs, and encryption secrets belong in environment/secret management, never in source control.
+
+## Privacy boundary
+
+Private:
+- acquisition data
+- sale data
+- buyer information
+- profit
+- internal notes
+- inventory IDs
+- provider observations and errors
+- pricing methodology/confidence/history
+- activity/audit logs
+
+Public data must be exposed through purpose-built DTOs.