feat(identity): F-005 register/login/logout with argon2 sessions and rate limiting

- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos
- Migration 002_identity: identity_users + identity_sessions (token hash only)
- Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL
- Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax
- LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown
- Anti-enumeration: identical generic 401 + dummy-hash timing equalization
- buildApp gains optional pool/cookieSecure; foundation-only app preserved
- 47 unit + 14 integration tests; live smoke covers all acceptance criteria

work/runtime-status.json

@@ -1,11 +1,152 @@
 {
-  "feature_id": null,
-  "stage": "idle",
+  "feature_id": "F-005",
+  "stage": "close",
   "agent": "leader",
-  "action": "Sin ejecución activa",
-  "state": "waiting",
+  "action": "F-005 cerrada con gates aprobados",
+  "state": "done",
   "next_agent": "leader",
   "waiting_for": "Seleccionar una feature pending y actualizar este estado",
-  "updated_at": "2026-08-14T20:29:18Z",
-  "timeline": []
+  "updated_at": "2026-08-14T20:58:24Z",
+  "timeline": [
+    {
+      "ts": "2026-08-14T20:39:25Z",
+      "agent": "leader",
+      "stage": "intake",
+      "state": "done",
+      "message": "Intake F-005 OK"
+    },
+    {
+      "ts": "2026-08-14T20:39:25Z",
+      "agent": "architect",
+      "stage": "design",
+      "state": "running",
+      "message": "Diseño módulo identity (hexagonal)"
+    },
+    {
+      "ts": "2026-08-14T20:41:17Z",
+      "agent": "architect",
+      "stage": "design",
+      "state": "done",
+      "message": "Diseño F-005 aprobado"
+    },
+    {
+      "ts": "2026-08-14T20:41:17Z",
+      "agent": "implementer",
+      "stage": "build",
+      "state": "running",
+      "message": "Implementando módulo identity"
+    },
+    {
+      "ts": "2026-08-14T20:51:41Z",
+      "agent": "implementer",
+      "stage": "build",
+      "state": "done",
+      "message": "Build F-005 completo con evidencia"
+    },
+    {
+      "ts": "2026-08-14T20:53:01Z",
+      "agent": "implementer",
+      "stage": "build",
+      "state": "running",
+      "message": "Fix de review: cobertura COOKIE_SECURE"
+    },
+    {
+      "ts": "2026-08-14T20:54:22Z",
+      "agent": "implementer",
+      "stage": "build",
+      "state": "done",
+      "message": "Fix de review aplicado y verificado"
+    },
+    {
+      "ts": "2026-08-14T20:54:22Z",
+      "agent": "reviewer",
+      "stage": "review_gate",
+      "state": "running",
+      "message": "Review gate F-005"
+    },
+    {
+      "ts": "2026-08-14T20:54:44Z",
+      "agent": "reviewer",
+      "stage": "review_gate",
+      "state": "done",
+      "message": "Review gate APPROVED"
+    },
+    {
+      "ts": "2026-08-14T20:55:17Z",
+      "agent": "security",
+      "stage": "security_gate",
+      "state": "running",
+      "message": "Security gate F-005"
+    },
+    {
+      "ts": "2026-08-14T20:55:17Z",
+      "agent": "security",
+      "stage": "security_gate",
+      "state": "done",
+      "message": "Security gate APPROVED"
+    },
+    {
+      "ts": "2026-08-14T20:55:17Z",
+      "agent": "qa",
+      "stage": "qa_gate",
+      "state": "running",
+      "message": "QA gate F-005"
+    },
+    {
+      "ts": "2026-08-14T20:55:36Z",
+      "agent": "qa",
+      "stage": "qa_gate",
+      "state": "done",
+      "message": "QA gate APPROVED"
+    },
+    {
+      "ts": "2026-08-14T20:55:36Z",
+      "agent": "documenter",
+      "stage": "document",
+      "state": "running",
+      "message": "Documentación F-005"
+    },
+    {
+      "ts": "2026-08-14T20:55:42Z",
+      "agent": "implementer",
+      "stage": "build",
+      "state": "running",
+      "message": "Docs README: auth contract"
+    },
+    {
+      "ts": "2026-08-14T20:57:22Z",
+      "agent": "implementer",
+      "stage": "build",
+      "state": "done",
+      "message": "README auth contract documentado"
+    },
+    {
+      "ts": "2026-08-14T20:57:22Z",
+      "agent": "documenter",
+      "stage": "document",
+      "state": "running",
+      "message": "Documentación F-005"
+    },
+    {
+      "ts": "2026-08-14T20:58:18Z",
+      "agent": "documenter",
+      "stage": "document",
+      "state": "done",
+      "message": "Docs F-005 completas"
+    },
+    {
+      "ts": "2026-08-14T20:58:24Z",
+      "agent": "leader",
+      "stage": "close",
+      "state": "running",
+      "message": "Cierre F-005"
+    },
+    {
+      "ts": "2026-08-14T20:58:24Z",
+      "agent": "leader",
+      "stage": "close",
+      "state": "done",
+      "message": "F-005 cerrada con gates aprobados"
+    }
+  ]
 }