// Package auth handles all authentication concerns: email verification codes
// (Redis-backed, rate-limited), password hashing (argon2id), JWT issuance
// (RS256, access 15 min + refresh 30 d), and the HTTP middleware that
// validates bearer tokens and injects claims into request context.
package auth