/**
 * ADR-003: Auth.js (NextAuth) with credentials + future OAuth
 *
 * Status: Accepted
 * Date: 2026-08-10
 *
 * Context:
 * Authentication must be enterprise-grade without hand-rolled crypto.
 * Need session security, optional OAuth, and tenant membership claims.
 *
 * Decision:
 * Use Auth.js (next-auth v5) with Credentials provider (Argon2/bcrypt hashing
 * via bcryptjs initially; migrate hashing algorithm to Argon2id when native
 * bindings are operational in deployment). Sessions use JWT strategy with
 * HttpOnly cookies. Platform admin MFA is a follow-up phase.
 *
 * Consequences:
 * + Mature auth lifecycle, adapters, and session handling
 * - Credentials provider requires careful rate limiting and lockout controls
 */
