Auth collections

The current implementation provides one built-in application-user identity domain, structurally separate from administrator accounts.

Registration stores normalized unique email, Argon2id password material, verification state, disable state and creation time. Administrators can inspect users and disable an identity, which revokes all its active sessions atomically from the product's perspective.