feat: establish core identity foundation

Adds Core-owned identity contracts, a Core-owned Better Auth database schema
(ekklesia_core_user/session/account/verification), a first-class Core-owned
migration source that coexists with module-owned migrations under the exact
existing migration system, and an explicit Better Auth construction boundary.
No authentication endpoint or sign-in UI is exposed yet (ADR 0010).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

core/src/cli/migration-command-support.ts

@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { discoverModuleMigrations, type ModuleMigrationAggregate } from "../modules/index.js";
+import { discoverAllMigrations } from "../migrations/index.js";
+import type { ModuleMigrationAggregate } from "../modules/index.js";
 
 interface PackageVersion {
   readonly version?: unknown;
@@ -22,9 +23,12 @@ export async function discoverRepositoryMigrations(
     readPackageVersion(path.join(repositoryRoot, "packages/module-sdk/package.json")),
   ]);
 
-  return discoverModuleMigrations({
-    moduleSdkVersion,
-    modulesDirectory: path.join(repositoryRoot, "modules"),
-    platformVersion,
+  return discoverAllMigrations({
+    coreMigrationsDirectory: path.join(repositoryRoot, "core", "drizzle"),
+    moduleDiscovery: {
+      moduleSdkVersion,
+      modulesDirectory: path.join(repositoryRoot, "modules"),
+      platformVersion,
+    },
   });
 }