feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

packages/validation/listing.js

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+
+export const createListingSchema = z
+  .object({
+    inventoryItemId: z.uuid(),
+    productName: z.string().trim().min(1).max(255),
+    categoryId: z.uuid(),
+    conditionId: z.uuid(),
+    askingPriceMinor: z.int().positive(),
+    imageCount: z.int().positive(),
+    notes: z.string().trim().max(10000).optional(),
+  })
+  .strict();