feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

docs/TESTING.md

@@ -0,0 +1,61 @@
+# Testing Strategy
+
+Testing begins with the first implementation.
+
+## Unit
+
+Test domain rules and pure services:
+- status transitions
+- listing requirements
+- cost basis
+- profit
+- valuation strategies
+- outlier handling
+- condition rules
+
+## API / integration
+
+Test:
+- authentication
+- authorization
+- repositories
+- API validation
+- Product/provider mapping
+- inventory lifecycle
+- sales transactions
+- public/private DTO boundaries
+
+## Component
+
+Test important Vue components and composables.
+
+## E2E
+
+Core workflows:
+1. Login
+2. Add Product
+3. Find/link provider mappings
+4. Add Inventory Item
+5. Upload images
+6. Calculate pricing
+7. Publish listing
+8. Search public site
+9. Record sale
+10. View dashboard
+
+## Accessibility
+
+Run automated accessibility checks and maintain manual keyboard/assistive technology coverage for critical workflows.
+
+## CI
+
+GitHub Actions should run:
+- linting
+- unit tests
+- integration/API tests
+- component tests
+- E2E tests as appropriate
+- accessibility checks
+- build validation
+
+Do not weaken or skip tests to obtain a passing build.