"""Authentication, users, and RBAC primitives.

See docs/designs/auth.md for the design. Public names are re-exported as the
package grows (models, security, config); no __all__ per project style.
"""
