docs: consolidate repository guides and preserve audit history

docs/security/authentication.md

@@ -1,84 +1,5 @@
 # Authentication
 
-## Purpose
+Local email/password accounts issue signed local JWTs and can use an HttpOnly `jobtracker_auth` session cookie. Google and Microsoft identity sign-in are optional and configured separately from Gmail/Graph mail access. Registration is disabled by default; email verification, Turnstile, and production auth requirements are configuration gates.
 
-Define user login and registration.
-
----
-
-# Supported Methods
-
-Users should be able to:
-
-## Email Registration
-
-Create account using:
-
-- Email.
-- Password.
-- Confirmation.
-
----
-
-## OAuth Registration/Login
-
-Support:
-
-- Google.
-- Microsoft.
-
----
-
-# Expected Behaviour
-
-If OAuth user does not exist:
-
-Create account automatically.
-
-Example:
-
-User clicks:
-
-"Continue with Google"
-
-↓
-
-Authenticate
-
-↓
-
-No account exists
-
-↓
-
-Create account
-
-↓
-
-Login
-
----
-
-# Password Requirements
-
-Support:
-
-- Secure hashing.
-- Password reset.
-- Password change.
-
----
-
-# Authentication UX
-
-Users should have:
-
-- Clear errors.
-- Loading states.
-- Recovery options.
-
-Avoid:
-
-"Authentication failed"
-
-without explanation.
+Password reset and verification use SMTP. TOTP two-factor authentication includes encrypted secrets, recovery codes, trusted devices, and pending-token flow. JWT issuer, audience, key, lifetime, and external client IDs are documented in [environment variables](../configuration/environment-variables.md).