feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

packages/validation/product.js

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+
+const identifier = z.uuid();
+
+export const createProductSchema = z
+  .object({
+    name: z.string().trim().min(1).max(255),
+    categoryId: identifier,
+  })
+  .strict();