feat: establish core identity foundation

Adds Core-owned identity contracts, a Core-owned Better Auth database schema
(ekklesia_core_user/session/account/verification), a first-class Core-owned
migration source that coexists with module-owned migrations under the exact
existing migration system, and an explicit Better Auth construction boundary.
No authentication endpoint or sign-in UI is exposed yet (ADR 0010).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

core/src/identity/schema.ts

@@ -0,0 +1,111 @@
+import { relations } from "drizzle-orm";
+import { boolean, index, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+
+/**
+ * Core-owned Better Auth schema for the four required core models: user, session, account,
+ * and verification. Table and index names are explicit and namespaced so ownership is
+ * unambiguous inside the shared public PostgreSQL schema. Columns, types, defaults, uniqueness,
+ * foreign keys, and delete behavior mirror the pinned [email protected] Drizzle/PostgreSQL
+ * generator output exactly (see docs/development/identity.md for the regeneration workflow).
+ */
+export const ekklesiaCoreUser = pgTable("ekklesia_core_user", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  emailVerified: boolean("email_verified").default(false).notNull(),
+  image: text("image"),
+  createdAt: timestamp("created_at").defaultNow().notNull(),
+  updatedAt: timestamp("updated_at")
+    .defaultNow()
+    .$onUpdate(() => new Date())
+    .notNull(),
+});
+
+export const ekklesiaCoreSession = pgTable(
+  "ekklesia_core_session",
+  {
+    id: text("id").primaryKey(),
+    expiresAt: timestamp("expires_at").notNull(),
+    token: text("token").notNull().unique(),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+      .$onUpdate(() => new Date())
+      .notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    userId: text("user_id")
+      .notNull()
+      .references(() => ekklesiaCoreUser.id, { onDelete: "cascade" }),
+  },
+  (table) => [index("ekklesia_core_session_user_id_idx").on(table.userId)],
+);
+
+export const ekklesiaCoreAccount = pgTable(
+  "ekklesia_core_account",
+  {
+    id: text("id").primaryKey(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => ekklesiaCoreUser.id, { onDelete: "cascade" }),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at"),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+    scope: text("scope"),
+    password: text("password"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (table) => [index("ekklesia_core_account_user_id_idx").on(table.userId)],
+);
+
+export const ekklesiaCoreVerification = pgTable(
+  "ekklesia_core_verification",
+  {
+    id: text("id").primaryKey(),
+    identifier: text("identifier").notNull(),
+    value: text("value").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (table) => [index("ekklesia_core_verification_identifier_idx").on(table.identifier)],
+);
+
+export const ekklesiaCoreUserRelations = relations(ekklesiaCoreUser, ({ many }) => ({
+  accounts: many(ekklesiaCoreAccount),
+  sessions: many(ekklesiaCoreSession),
+}));
+
+export const ekklesiaCoreSessionRelations = relations(ekklesiaCoreSession, ({ one }) => ({
+  user: one(ekklesiaCoreUser, {
+    fields: [ekklesiaCoreSession.userId],
+    references: [ekklesiaCoreUser.id],
+  }),
+}));
+
+export const ekklesiaCoreAccountRelations = relations(ekklesiaCoreAccount, ({ one }) => ({
+  user: one(ekklesiaCoreUser, {
+    fields: [ekklesiaCoreAccount.userId],
+    references: [ekklesiaCoreUser.id],
+  }),
+}));
+
+/**
+ * Explicit mapping from Better Auth's logical core model names to Ekklesia's physical schema
+ * objects. Passed directly to the Drizzle adapter so table naming is never inferred by accident.
+ */
+export const identityAdapterSchema = {
+  account: ekklesiaCoreAccount,
+  session: ekklesiaCoreSession,
+  user: ekklesiaCoreUser,
+  verification: ekklesiaCoreVerification,
+} as const;