feat: establish core identity foundation

Adds Core-owned identity contracts, a Core-owned Better Auth database schema
(ekklesia_core_user/session/account/verification), a first-class Core-owned
migration source that coexists with module-owned migrations under the exact
existing migration system, and an explicit Better Auth construction boundary.
No authentication endpoint or sign-in UI is exposed yet (ADR 0010).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

package.json

@@ -16,6 +16,7 @@
     "doctor": "node scripts/run-doctor.ts",
     "format": "biome format --write .",
     "format:check": "biome format .",
+    "identity:schema:validate": "turbo run build && node core/dist/cli/validate-identity-schema.js",
     "infrastructure:config": "docker compose --env-file .env.example -f infrastructure/compose.yaml config --quiet",
     "infrastructure:down": "docker compose --env-file .env -f infrastructure/compose.yaml down",
     "infrastructure:logs": "docker compose --env-file .env -f infrastructure/compose.yaml logs --follow",
@@ -33,7 +34,7 @@
     "test:watch": "vitest",
     "typecheck": "turbo run typecheck typecheck:root",
     "typecheck:root": "tsc --noEmit --project tsconfig.json",
-    "verify": "pnpm format:check && pnpm lint && pnpm boundaries && pnpm typecheck && pnpm test && pnpm modules:validate && pnpm migrations:validate && pnpm build"
+    "verify": "pnpm format:check && pnpm lint && pnpm boundaries && pnpm typecheck && pnpm test && pnpm modules:validate && pnpm migrations:validate && pnpm identity:schema:validate && pnpm build"
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.3",