feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

drizzle.config.js

@@ -0,0 +1,17 @@
+import { defineConfig } from 'drizzle-kit';
+import 'dotenv/config';
+
+const databaseUrl = process.env.DATABASE_URL;
+
+if (!databaseUrl) {
+  throw new Error('DATABASE_URL is required to manage database migrations.');
+}
+
+export default defineConfig({
+  dialect: 'postgresql',
+  schema: './apps/api/src/infrastructure/database/schema.js',
+  out: './database/migrations',
+  dbCredentials: {
+    url: databaseUrl,
+  },
+});