iamdoubz 13733ac262 auth: sessions, login/logout/me/change-password, CSRF, guards, audit ...

argon2id passwords with a min length and a common-password list (SecLists,
MIT). Login failures are limited per IP and per email; must_change_password
blocks everything outside /api/auth/*. The first admin is created from env
on startup. pnpm dev derives DATABASE_URL from .env.

Task: M1-T3

2026-10-17 15:08:44 -05:00

..

shared

auth: sessions, login/logout/me/change-password, CSRF, guards, audit

2026-10-17 15:08:44 -05:00