feat: establish core identity foundation

Adds Core-owned identity contracts, a Core-owned Better Auth database schema
(ekklesia_core_user/session/account/verification), a first-class Core-owned
migration source that coexists with module-owned migrations under the exact
existing migration system, and an explicit Better Auth construction boundary.
No authentication endpoint or sign-in UI is exposed yet (ADR 0010).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

core/src/migrations/aggregate.ts

@@ -0,0 +1,47 @@
+import {
+  discoverModuleMigrations,
+  type ModuleDiscoveryOptions,
+  type ModuleMigrationAggregate,
+  ModuleMigrationDiscoveryError,
+} from "../modules/index.js";
+import { CORE_MIGRATION_SOURCE_ID, discoverCoreMigrations } from "./core-source.js";
+
+export interface DiscoverAllMigrationsOptions {
+  readonly coreMigrationsDirectory: string;
+  readonly moduleDiscovery: ModuleDiscoveryOptions;
+}
+
+/**
+ * Discovers Core's own migrations and every installed module's migrations, then merges them into
+ * one frozen `ModuleMigrationAggregate` with Core's migrations ordered first. Core has no
+ * dependency relationship with feature modules, so it is not part of the module dependency graph;
+ * it simply precedes every module in the aggregate the planner and runner already consume
+ * unmodified. There remains exactly one migration aggregate and one executor.
+ */
+export async function discoverAllMigrations(
+  options: DiscoverAllMigrationsOptions,
+): Promise<ModuleMigrationAggregate> {
+  const [coreMigrations, moduleAggregate] = await Promise.all([
+    discoverCoreMigrations({ coreMigrationsDirectory: options.coreMigrationsDirectory }),
+    discoverModuleMigrations(options.moduleDiscovery),
+  ]);
+
+  if (moduleAggregate.modules.some((module) => module.moduleId === CORE_MIGRATION_SOURCE_ID)) {
+    throw new ModuleMigrationDiscoveryError([
+      {
+        code: "MODULE_MIGRATION_ID_DUPLICATE",
+        message: `The identifier "${CORE_MIGRATION_SOURCE_ID}" is reserved for Core-owned migrations and cannot be used by an installed module.`,
+        moduleId: CORE_MIGRATION_SOURCE_ID,
+      },
+    ]);
+  }
+
+  return Object.freeze({
+    discoveredModules: moduleAggregate.discoveredModules,
+    migrations: Object.freeze([...coreMigrations, ...moduleAggregate.migrations]),
+    modules: Object.freeze([
+      Object.freeze({ migrations: coreMigrations, moduleId: CORE_MIGRATION_SOURCE_ID }),
+      ...moduleAggregate.modules,
+    ]),
+  });
+}

core/src/migrations/core-source.ts

@@ -0,0 +1,42 @@
+import type { ModuleId } from "@ekklesia/contracts";
+import {
+  type DiscoveredModuleMigration,
+  inspectMigrationsAtPath,
+  ModuleMigrationDiscoveryError,
+  type ModuleMigrationDiscoveryIssue,
+} from "../modules/migration-discovery.js";
+
+/**
+ * The reserved migration-source identifier for Core-owned platform schema (starting with
+ * identity). It is not a module: Core is never discovered through `discoverModules`, never has
+ * an `ekklesia.module.json` manifest, and never runs a server entrypoint. It reuses the exact
+ * same journal/checksum/breakpoint/destructive-policy validation as module migrations so there
+ * remains exactly one migration format and one executor.
+ */
+export const CORE_MIGRATION_SOURCE_ID: ModuleId = "core";
+
+export interface CoreMigrationDiscoveryOptions {
+  readonly coreMigrationsDirectory: string;
+}
+
+/**
+ * Discovers Core's own migration inventory at `coreMigrationsDirectory` (the package-local
+ * `core/drizzle` directory). Performs no PostgreSQL connection or module discovery; it only
+ * validates packaged Drizzle migration artifacts, exactly like module migration discovery.
+ */
+export async function discoverCoreMigrations(
+  options: CoreMigrationDiscoveryOptions,
+): Promise<readonly DiscoveredModuleMigration[]> {
+  const issues: ModuleMigrationDiscoveryIssue[] = [];
+  const migrations = await inspectMigrationsAtPath(
+    CORE_MIGRATION_SOURCE_ID,
+    options.coreMigrationsDirectory,
+    issues,
+  );
+
+  if (issues.length > 0) {
+    throw new ModuleMigrationDiscoveryError(issues);
+  }
+
+  return migrations;
+}

core/src/migrations/index.ts

@@ -1,2 +1,4 @@
+export * from "./aggregate.js";
+export * from "./core-source.js";
 export * from "./postgres-database.js";
 export * from "./runner.js";