feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

packages/contracts/inventory.js

@@ -0,0 +1,15 @@
+function toIsoString(value) {
+  return value instanceof Date ? value.toISOString() : value;
+}
+
+export function toAdminInventoryItemDto(inventoryItem) {
+  return {
+    id: inventoryItem.id,
+    productId: inventoryItem.productId,
+    conditionId: inventoryItem.conditionId,
+    status: inventoryItem.status,
+    notes: inventoryItem.notes ?? null,
+    createdAt: toIsoString(inventoryItem.createdAt),
+    updatedAt: toIsoString(inventoryItem.updatedAt),
+  };
+}