feat: establish core identity foundation

Adds Core-owned identity contracts, a Core-owned Better Auth database schema
(ekklesia_core_user/session/account/verification), a first-class Core-owned
migration source that coexists with module-owned migrations under the exact
existing migration system, and an explicit Better Auth construction boundary.
No authentication endpoint or sign-in UI is exposed yet (ADR 0010).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

docs/development/repository-workflow.md

@@ -19,7 +19,8 @@ pnpm format:check  # formatting without mutation
 pnpm lint          # Biome recommended rules
 pnpm boundaries    # architectural directions, UI ownership, and cycles
 pnpm modules:validate # installed module manifests, compatibility, and dependency graph
-pnpm migrations:validate # offline module migration inventory and exact checksums
+pnpm migrations:validate # offline Core + module migration inventory and exact checksums
+pnpm identity:schema:validate # detects drift against the pinned Better Auth schema generator
 pnpm migrations:plan # read-only comparison with PostgreSQL applied history
 pnpm migrations:apply # locked, transactional application of the pending batch
 pnpm doctor        # build-first, read-only human readiness dashboard
@@ -41,9 +42,16 @@ schema entrypoints are loaded and validated for table ownership, namespacing, du
 foreign-key isolation; this command does not connect to PostgreSQL or run migrations.
 
 `pnpm migrations:validate` also builds first, completes static module discovery, and atomically
-checks every declared stable Drizzle migration directory. It reports dependency-first module
-inventories and exact SHA-256 checksums without importing module code, connecting to PostgreSQL, or
-executing SQL. Modules with no migration history are valid.
+checks Core's own `core/drizzle` migration directory together with every declared module Drizzle
+migration directory. It reports Core's migration first, followed by dependency-first module
+inventories, with exact SHA-256 checksums, without importing module code, connecting to
+PostgreSQL, or executing SQL. Modules with no migration history are valid.
+
+`pnpm identity:schema:validate` regenerates Better Auth's canonical schema with the pinned local
+`auth` CLI into a temporary, package-local directory, structurally compares every core model
+(columns, types, nullability, defaults, foreign keys, and indexes) against the checked-in
+`core/src/identity/schema.ts`, and always removes the temporary output. It requires no
+`DATABASE_URL`. See [Identity](identity.md) for the full upgrade workflow.
 
 ## Developer Doctor
 
@@ -66,8 +74,12 @@ Doctor reports a fixed, deterministic set of checks:
 - Schema discovery, including validated module and table counts. This imports compiled schema
   definitions, which the module contract requires to perform no configuration reads, I/O, or
   database connection.
-- Offline migration discovery, with safe identities and consistently truncated checksums.
+- Offline migration discovery for Core's own identity migration and every module, with safe
+  identities and consistently truncated checksums, Core listed first.
 - PostgreSQL connectivity and read-only applied-history planning when `DATABASE_URL` is configured.
+- Identity runtime configuration: skipped (not a failure) when no secret, base URL, or trusted
+  origins are set; otherwise validated with `createIdentityConfig` and reported pass or failure.
+  This check never constructs Better Auth or opens a database connection.
 - Object storage as skipped while Core has no production storage client or configuration contract.
 
 Every check has a stable ID and one of four states: pass, warning, failure, or skipped. Independent
@@ -94,7 +106,8 @@ Data definitions
   ✓ Schemas validated
     0 modules · 0 tables
   ✓ Migrations validated
-    0 migrations · checksums valid
+    1 migration · checksums valid
+    core:0000_identity_core_tables · f8f2086ef06f
 
 PostgreSQL
   ○ Connection check skipped
@@ -102,6 +115,11 @@ PostgreSQL
   ○ Migration plan skipped
     A validated migration inventory and configured PostgreSQL connection are required.
 
+Identity
+  ○ Identity configuration skipped
+    Core identity schema defines 4 tables (ekklesia_core_account, ekklesia_core_session, ekklesia_core_user, ekklesia_core_verification).
+    Identity runtime configuration (signing key, base URL, trusted origins) is not set.
+
 Object storage
   ○ Check unavailable
     Core storage integration has not been implemented yet.
@@ -112,8 +130,9 @@ Result: READY WITH WARNINGS
 Doctor is a local, human-readable summary. `pnpm verify`, `pnpm ci:verify`, infrastructure smoke,
 and migration smoke remain the authoritative automated evidence because they exercise formatting,
 boundaries, types, tests, builds, containers, and live mutation/rollback behavior that Doctor does
-not repeat. Phase 4 identity with Better Auth is the next architectural phase; Doctor does not
-diagnose identity, authorization, HTTP routing, runtime module health, or production storage yet.
+not repeat. Identity HTTP transport and an explicit enrollment policy are the next architectural
+phase; Doctor does not diagnose authorization, HTTP routing, runtime module health, or production
+storage yet, and it never constructs an operational Better Auth instance or claims sign-in works.
 
 Migration planning and application require `DATABASE_URL`. Keep it in the uncommitted `.env`
 created from `.env.example`: