feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/auth/2fa.md

@@ -1,3 +1,8 @@
 # 2fa
 
-TODO: Complete documentation.
+Local accounts can enable TOTP from Profile settings. Setup requires the current password, verification
+of the first six-digit code, and acknowledgement of one-time recovery codes. Users can disable TOTP,
+regenerate recovery codes, list/revoke trusted devices, and revoke every trusted device.
+
+Challenge attempts are rate-limited. Recovery codes are hashed at rest and shown only when generated.
+See `docs/security/two-factor-authentication.md` for the detailed trust model.

docs/auth/login.md

@@ -1,3 +1,9 @@
 # login
 
-TODO: Complete documentation.
+`POST /api/auth/login` accepts email, password, and remember-me preference. Successful local login
+issues an HttpOnly session cookie plus a readable CSRF cookie. Accounts with two-factor authentication
+receive a short-lived pending token and must complete `POST /api/auth/2fa/challenge` before a session is
+issued. Login and challenge endpoints are rate-limited.
+
+The frontend route is `/login`; registration has its own `/register` route. Authentication errors are
+shown without exposing whether an unknown account exists.

docs/auth/oauth.md

@@ -1,3 +1,9 @@
 # oauth
 
-TODO: Complete documentation.
+Google and Microsoft sign-in exchange provider identity tokens for a normal Jobjakt local session.
+Verified provider email addresses may link to the matching local account; provider subject identifiers
+are then retained for stable future sign-in. Gmail and Microsoft Graph mailbox connections use separate
+OAuth flows and state validation because they grant mailbox permissions, not application login.
+
+Provider client IDs and secrets belong in environment configuration, never the repository. See
+`docs/architecture/authentication.md` and the connected-account settings UI.

docs/auth/overview.md

@@ -1,3 +1,10 @@
 # overview
 
-TODO: Complete documentation.
+Jobjakt supports local email/password sessions plus optional Google and Microsoft identity exchange.
+Local access tokens are stored in an HttpOnly `jobtracker_session` cookie; mutating cookie-authenticated
+requests also require the double-submit CSRF token. Identity, sessions, two-factor authentication,
+trusted devices, email verification, and password reset are implemented by the controllers and services
+under `JobTrackerApi/Controllers` and `JobTrackerApi/Services`.
+
+Production authentication fails closed when required configuration is missing. See
+`docs/architecture/authentication.md` and `docs/security/authentication.md` for the security model.

docs/auth/signup.md

@@ -1,3 +1,8 @@
 # signup
 
-TODO: Complete documentation.
+Self-service signup uses `POST /api/auth/register` and the `/register` frontend route. It is disabled
+unless `Auth:AllowRegistration`/`AUTH_ALLOW_REGISTRATION` is enabled. When Cloudflare Turnstile keys
+are configured, the server validates the widget token through Siteverify before creating the account.
+
+Production activation is intentionally blocked until the operator supplies Turnstile configuration;
+see `BLOCKERS.md`. Email verification can also be required before the first login.