feat(identity): F-005 register/login/logout with argon2 sessions and rate limiting

- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos
- Migration 002_identity: identity_users + identity_sessions (token hash only)
- Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL
- Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax
- LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown
- Anti-enumeration: identical generic 401 + dummy-hash timing equalization
- buildApp gains optional pool/cookieSecure; foundation-only app preserved
- 47 unit + 14 integration tests; live smoke covers all acceptance criteria

project/.env.example

@@ -7,3 +7,7 @@ REDIS_URL=redis://localhost:6379
 # Feature flags: FLAG_<NAME>=true|false (parsed into the flag store at boot).
 # Unknown flags default to OFF. Flags can be flipped at runtime via the store.
 FLAG_EXAMPLE_FEATURE=false
+
+# Session cookie Secure flag. Defaults to true (production-safe); set false only
+# for local http development where browsers reject Secure cookies.
+COOKIE_SECURE=false