feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

packages/contracts/auth.js

@@ -0,0 +1,23 @@
+function toIsoString(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+
+export function toSessionDto(session, currentSessionId) {
+  return {
+    id: session.id,
+    createdAt: toIsoString(session.createdAt),
+    expiresAt: toIsoString(session.expiresAt),
+    lastActivityAt: toIsoString(session.lastActivityAt),
+    ipAddress: session.ipAddress,
+    userAgent: session.userAgent,
+    isCurrent: session.id === currentSessionId,
+  };
+}
+
+export function toMfaMethodDto(method) {
+  return {
+    id: method.id,
+    name: method.name,
+    type: method.type,
+  };
+}