**Parent tracker** — Devkit auth & session hardening. Groups the pluggable auth provider work + session-token security. Sub-issues below.
Parent tracker — Devkit auth & session hardening. Groups the pluggable auth provider work + session-token security. Sub-issues below.