feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

packages/validation/auth.js

@@ -0,0 +1,34 @@
+import { z } from 'zod';
+
+export const loginSchema = z
+  .object({
+    email: z.string().trim().email().max(320),
+    password: z.string().min(1).max(1024),
+    mfaCode: z.string().regex(/^\d{6}$/).optional(),
+    rememberMe: z.boolean().optional(),
+  })
+  .strict();
+
+export const sessionIdSchema = z.uuid();
+
+export const requestPasswordResetSchema = z
+  .object({ email: z.string().trim().email().max(320) })
+  .strict();
+
+export const resetPasswordSchema = z
+  .object({
+    token: z.string().min(32).max(512),
+    password: z.string().min(12).max(1024),
+  })
+  .strict();
+
+export const enrollMfaSchema = z
+  .object({ name: z.string().trim().min(1).max(100) })
+  .strict();
+
+export const verifyMfaSchema = z
+  .object({
+    methodId: z.uuid(),
+    code: z.string().regex(/^\d{6}$/),
+  })
+  .strict();