feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

packages/validation/image.js

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+
+export const createInventoryImageSchema = z.object({
+  storageKey: z.string().trim().min(1).max(500),
+  originalFilename: z.string().trim().min(1).max(255),
+  mimeType: z.enum(['image/jpeg', 'image/png', 'image/webp']),
+  fileSize: z.int().positive(),
+  width: z.int().positive(),
+  height: z.int().positive(),
+  altText: z.string().trim().max(1000).optional(),
+  sortOrder: z.int().nonnegative().optional(),
+  isPrimary: z.boolean().optional(),
+}).strict();