feat: establish core identity foundation

Adds Core-owned identity contracts, a Core-owned Better Auth database schema
(ekklesia_core_user/session/account/verification), a first-class Core-owned
migration source that coexists with module-owned migrations under the exact
existing migration system, and an explicit Better Auth construction boundary.
No authentication endpoint or sign-in UI is exposed yet (ADR 0010).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

core/src/modules/migration-discovery.ts

@@ -577,16 +577,17 @@ function validateInventory(
   });
 }
 
-async function inspectModuleMigrations(
-  discovered: DiscoveredModule,
+/**
+ * Validates and reads the Drizzle migration inventory at `migrationRoot`, attributing every
+ * migration and issue to `moduleId`. Shared by module-owned discovery (moduleId taken from the
+ * module manifest) and Core's own migration source (moduleId fixed to "core"), so both reuse the
+ * exact same journal, checksum, breakpoint, and destructive-policy validation.
+ */
+export async function inspectMigrationsAtPath(
+  moduleId: ModuleId,
+  migrationRoot: string,
   issues: ModuleMigrationDiscoveryIssue[],
 ): Promise<readonly DiscoveredModuleMigration[]> {
-  const moduleId = discovered.manifest.id;
-  const migrationRoot = discovered.entrypoints.migrations;
-  if (!migrationRoot) {
-    return Object.freeze([]);
-  }
-
   const issueCountBeforeModule = issues.length;
   const inventory = await readInventory(migrationRoot, moduleId, issues);
   const [journalBytes, policyBytes] = await Promise.all([
@@ -734,6 +735,17 @@ async function inspectModuleMigrations(
   return Object.freeze(migrations);
 }
 
+async function inspectModuleMigrations(
+  discovered: DiscoveredModule,
+  issues: ModuleMigrationDiscoveryIssue[],
+): Promise<readonly DiscoveredModuleMigration[]> {
+  const migrationRoot = discovered.entrypoints.migrations;
+  if (!migrationRoot) {
+    return Object.freeze([]);
+  }
+  return inspectMigrationsAtPath(discovered.manifest.id, migrationRoot, issues);
+}
+
 export async function discoverModuleMigrations(
   options: ModuleDiscoveryOptions,
 ): Promise<ModuleMigrationAggregate> {