Add authentication domain persistence foundation

[codemountains]

Context

Closes #103. Contributes the P1 foundation tracked by #110 without implementing the P2-P7 authentication flows in #104-#109.

The later scoped-PAT, authorization, browser auth, Device Authorization, and CLI session phases need a stable persistence and shared-contract boundary. This PR adds that boundary while keeping the current token-only runtime operational.

Changes

• add the auth-domain D1 migration for accounts, provider identities, Better Auth browser-account mappings, Device Authorizations, CLI sessions, access tokens, refresh tokens, Personal Access Tokens, and PAT idempotency records
• preserve the existing tokens table and keep Better Auth adapter tables outside the API migration boundary
• add focused D1/in-memory repository ports and adapters with matching primary-key, uniqueness, and foreign-key behavior
• add shared auth IDs, scope/status unions, AuthPrincipal, credential metadata, account/device/refresh/PAT API contracts, and structured auth error codes
• document the independent app.{domain} worker boundary, provider-token non-persistence, legacy-token migration staging, and GitHub CLI-style --insecure-storage fallback behavior

Documentation and contracts

• Product scope, MVP, or positioning in requirements/barestash.spec.md
• CLI commands, flags, output, auth, tokens, endpoints, or events in requirements/barestash-cli-design.spec.md
• Technical design, operations, topology, or runbooks in docs/
• README or onboarding guidance
• Public API, event schema, JSON/JSONL output, or streaming behavior
• No documentation or public contract changes

The authentication source of truth in requirements/barestash-authentication-authorization.spec.md is also updated.

Security and data handling

• This PR does not include tokens, credentials, private endpoint URLs, captured raw payloads, or user data.
• Raw payloads, headers, logs, errors, and fixtures are redacted or intentionally safe.
• Token secrets are not exposed outside creation-time flows.
• Destructive or remote side effects are documented and require explicit user intent.
• Not applicable.

Provider access/refresh tokens and raw Barestash credentials have no persistence columns in the new domain schema. Repository fixtures contain synthetic hashes only.

Verification

pnpm --filter @barestash/shared test          # RED then GREEN: 52 passed
pnpm --filter @barestash/api test -- migrations/auth-domain-repository.test.ts
                                               # RED then GREEN; final focused run included 209 passed
just check                                     # 54 files, 399 tests passed
just test-e2e                                  # 1 file, 5 tests passed
git diff --check                               # passed

Skipped checks or residual risk:

• None.

Review notes

• The repository code-reviewer found one Medium issue: the in-memory adapter initially did not mirror D1 uniqueness and foreign-key failures. This was fixed with shared constraint-parity tests and complete create-time constraint enforcement; focused re-review confirmed the finding is resolved with no remaining findings.
• Conditional Device Authorization transitions, atomic refresh rotation, atomic PAT/idempotency creation, scoped bearer authentication, and runtime route wiring remain intentionally assigned to [Auth P2] Scoped PATs, current-account API, and common principal authentication #104-[Auth P6] CLI Device login, credential storage, refresh, and revocation #108.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9dc9f2b9e6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".