feat(identity): F-005 register/login/logout with argon2 sessions and rate limiting

- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos
- Migration 002_identity: identity_users + identity_sessions (token hash only)
- Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL
- Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax
- LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown
- Anti-enumeration: identical generic 401 + dummy-hash timing equalization
- buildApp gains optional pool/cookieSecure; foundation-only app preserved
- 47 unit + 14 integration tests; live smoke covers all acceptance criteria

work/artifacts/F-005/leader-close.json

@@ -0,0 +1,37 @@
+{
+  "feature_id": "F-005",
+  "agent": "leader",
+  "verdict": "APPROVED",
+  "summary": "F-005 closed. First real business module: identity is hexagonal end-to-end, the server is the only authority for who calls the API, and brute force, enumeration and session theft are all handled server-side. All gates APPROVED, verify.sh exit 0.",
+  "gates": {
+    "reviewer": "APPROVED (reviewer.json)",
+    "security": "APPROVED (security.json)",
+    "qa": "APPROVED (qa.json)",
+    "verify_sh": "exit 0"
+  },
+  "deliverables": [
+    "migrations/002_identity.js (identity_users + identity_sessions, reversible, token_hash UNIQUE)",
+    "src/modules/identity hexagonal: domain ports, use cases (register/login/logout), argon2id hasher, pg repos, routes",
+    "Opaque 512-bit session tokens; DB persists only SHA-256 hashes; 7-day TTL enforced in SQL",
+    "LoginRateLimiter interface + in-memory impl: 10 failures -> 429 + Retry-After, 15-min cooldown, reset on success",
+    "Anti-enumeration: identical generic 401 + dummy-hash timing equalization",
+    "buildApp(pool, cookieSecure) wiring; foundation-only app preserved without pool",
+    "47 unit + 14 integration tests; live curl smoke for every acceptance criterion",
+    "README Authentication section, spec/tech.md dependency justification, .env.example COOKIE_SECURE"
+  ],
+  "process_notes": [
+    "Review gate caught missing COOKIE_SECURE test coverage; bounced to build, fixed, re-verified — gate earned its keep.",
+    "Adding migration 002 broke the F-002 single-step rollback test by design; updated to full revert (count:0) asserting both module tables and baseline disappear."
+  ],
+  "next_feature_hint": "F-006 users/profile/RBAC builds directly on identity_users and the session model -> recommended next",
+  "evidence": [
+    "work/artifacts/F-005/architect.md",
+    "work/artifacts/F-005/implementer.md",
+    "work/artifacts/F-005/reviewer.json",
+    "work/artifacts/F-005/security.json",
+    "work/artifacts/F-005/qa.json",
+    "work/artifacts/F-005/documenter.md",
+    "./scripts/verify.sh exit 0 at close"
+  ],
+  "timestamp": "2026-08-14T21:15:00Z"
+}