feat(identity): F-005 register/login/logout with argon2 sessions and rate limiting

- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos
- Migration 002_identity: identity_users + identity_sessions (token hash only)
- Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL
- Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax
- LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown
- Anti-enumeration: identical generic 401 + dummy-hash timing equalization
- buildApp gains optional pool/cookieSecure; foundation-only app preserved
- 47 unit + 14 integration tests; live smoke covers all acceptance criteria

work/artifacts/F-005/documenter.md

@@ -0,0 +1,22 @@
+# Documenter — F-005 Identity: register, login, sessions
+
+done -> work/artifacts/F-005/documenter.md
+
+## Docs updated
+- `project/README.md`:
+  - Configuration: `COOKIE_SECURE` documented (default true).
+  - HTTP contract: auth error codes (`INVALID_CREDENTIALS` 401,
+    `EMAIL_ALREADY_REGISTERED` 409, `TOO_MANY_ATTEMPTS` 429 + Retry-After).
+  - New "Authentication (identity module)" section: endpoints table, argon2id,
+    opaque-token sessions (DB stores only SHA-256 hash), cookie flags,
+    anti-enumeration + rate-limit behavior, pool-gated wiring.
+  - Layout: modules list now shows health/flags/identity; infrastructure mentions
+    db pool + config + logging; shared mentions input parsing.
+- `spec/tech.md`: argon2 + @fastify/cookie justified (F-005 row).
+- `project/.env.example`: `COOKIE_SECURE=false` with local-dev comment.
+
+## Specs (source of truth for this ticket)
+- specs/F-005-identity/SPEC.md, DESIGN.md, TASKS.md, TESTS.md
+
+## Evidence trail
+- work/artifacts/F-005/: architect.md, implementer.md, reviewer.json, security.json, qa.json