Implements pansy's local (email + password) authentication and the
session layer that OIDC (#5) will also reuse.

- store: users.go (create/get-by-id/get-by-email/count) and sessions.go
  (create/get/touch/delete/delete-expired), scanning the existing 0001
  schema.
- service: the business-logic seam. auth.go (Register/Login/session
  lifecycle/Providers) + password.go (argon2id, 64 MiB/1/4, PHC-encoded,
  constant-time verify) + service.go (Service, clock injection, token
  hashing). First user is admin; closed registration still allows the
  bootstrap user; unknown-email and wrong-password are indistinguishable
  (same error, same argon2 work via a dummy hash).
- api: POST /auth/register|login|logout, GET /auth/me|providers, plus a
  requireAuth middleware that resolves the HttpOnly session cookie
  (SameSite=Lax, Secure under https) to the actor. Handlers stay thin.
- main: wires the service and a periodic expired-session sweep; sessions
  are also dropped lazily on access. Sliding 30-day expiry.
- tests: service (register/login/expiry/renewal/cleanup, password) and
  api (cookie flow, middleware, validation, providers).

Verified end-to-end via curl: register -> me -> restart -> session
persists -> logout -> 401.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

@@ -0,0 +22,4 @@
+
+// registerRequest / loginRequest are the JSON bodies for the local-auth
+// endpoints. gin's binding validates them before the service is called.
+type registerRequest struct {

@@ -0,0 +30,4 @@
+
+type loginRequest struct {
+	Email    string `json:"email" binding:"required,email"`
+	Password string `json:"password" binding:"required"`

@@ -0,0 +51,4 @@
+		return
+	}
+
+	if err := h.startSession(c, user.ID); err != nil {

@@ -0,0 +59,4 @@
+}
+
+// login verifies credentials and sets the session cookie.
+func (h *handlers) login(c *gin.Context) {

@@ -0,0 +104,4 @@
+// requireAuth is middleware that rejects requests without a valid session and,
+// on success, stashes the resolved user in the context. Feature routers added by
+// later issues (gardens, objects, …) attach this to their protected groups.
+func (h *handlers) requireAuth() gin.HandlerFunc {

@@ -0,0 +108,4 @@
+	return func(c *gin.Context) {
+		token, err := c.Cookie(sessionCookie)
+		if err != nil || token == "" {
+			writeAPIError(c, http.StatusUnauthorized, "UNAUTHENTICATED", "authentication required")

@@ -0,0 +138,4 @@
+// cookieSecure reports whether the session cookie should carry the Secure
+// attribute: only when the instance is served over HTTPS (PANSY_BASE_URL).
+// Marking it Secure under plain-http local dev would make the browser drop it.
+func (h *handlers) cookieSecure() bool {

@@ -0,0 +143,4 @@
+}
+
+func (h *handlers) setSessionCookie(c *gin.Context, token string, expiresAt time.Time) {
+	maxAge := max(int(time.Until(expiresAt).Seconds()), 1)

@@ -0,0 +161,4 @@
+
+// writeServiceError maps a service-layer sentinel error to pansy's JSON error
+// envelope. Login failures never leak which of email/password was wrong.
+func (h *handlers) writeServiceError(c *gin.Context, err error) {

@@ -0,0 +43,4 @@
+	if !s.cfg.LocalAuth {
+		return nil, domain.ErrLocalAuthDisabled
+	}
+

@@ -0,0 +50,4 @@
+		return nil, domain.ErrInvalidInput
+	}
+
+	count, err := s.store.CountUsers(ctx)

@@ -0,0 +74,4 @@
+		return nil, err
+	}
+
+	return s.store.CreateUser(ctx, &domain.User{

@@ -0,0 +78,4 @@
+		Email:        email,
+		DisplayName:  displayName,
+		PasswordHash: &hash,
+		IsAdmin:      count == 0,

@@ -0,0 +94,4 @@
+	switch {
+	case errors.Is(err, domain.ErrNotFound):
+		// Spend comparable time so timing can't distinguish a missing account.
+		_, _ = verifyPassword(s.dummyHash, password)

@@ -0,0 +104,4 @@
+		return nil, domain.ErrInvalidCredentials
+	}
+
+	ok, err := verifyPassword(*u.PasswordHash, password)

@@ -0,0 +138,4 @@
+		return nil, domain.ErrNotFound
+	}
+	hash := hashToken(rawToken)
+	sess, err := s.store.GetSession(ctx, hash)

@@ -0,0 +146,4 @@
+	exp, err := parseTime(sess.ExpiresAt)
+	if err != nil {
+		// A corrupt expiry means we can't trust the session; drop it.
+		_ = s.store.DeleteSession(ctx, hash)

@@ -0,0 +152,4 @@
+
+	now := s.now()
+	if !now.Before(exp) {
+		_ = s.store.DeleteSession(ctx, hash)

@@ -0,0 +156,4 @@
+		return nil, domain.ErrNotFound
+	}
+
+	if newExp := now.Add(sessionTTL); newExp.Sub(exp) > time.Hour {

@@ -0,0 +17,4 @@
+// later leaves old hashes verifiable.
+const (
+	argonMemKiB  = 64 * 1024 // 64 MiB
+	argonTime    = 1

@@ -0,0 +24,4 @@
+)
+
+// errBadHash marks a stored hash string that could not be parsed — a data or
+// programming error, not a wrong password. Callers treat it as an auth failure

@@ -0,0 +66,4 @@
+	}
+
+	var version int
+	if _, err := fmt.Sscanf(parts[2], "v=%d", &version); err != nil || version != argon2.Version {

@@ -0,0 +1,76 @@
+// Package service is pansy's business-logic seam: every operation is a method on
+// *Service taking (ctx, actor, args), and all permission checks and invariants

@@ -0,0 +42,4 @@
+// New constructs a Service. It precomputes a dummy password hash used to
+// equalize login timing; if that fails (it shouldn't), login still works but
+// loses the timing defense.
+func New(st *store.DB, cfg *config.Config) *Service {

@@ -0,0 +19,4 @@
+}
+
+// scanUser reads one users row. is_admin is stored as INTEGER 0/1 (the driver
+// returns it as int64, which does not convert straight to bool), so it is read