fix: harden identity HTTP transport

docs/development/identity.md

@@ -149,6 +149,23 @@ exported from `@ekklesia/core/identity`, exposes `auth.api`, Better Auth's sessi
 Drizzle adapter, the raw database, a session token, or Better Auth configuration. `apps/api` is the
 only current consumer of this boundary; see [API](api.md).
 
+Construction also explicitly configures four things the pinned release would otherwise leave on an
+environment-sensitive or implicit default, all covered by [ADR 0012](../architecture/decisions/0012-identity-origin-csrf-protection-under-test.md)
+and [API](api.md#logging):
+`advanced.disableCSRFCheck`/`disableOriginCheck` are both pinned to `false` (the default silently
+skips both under a test runner), Better Auth's `logger` is replaced with one that drops its message
+and arguments and emits only a fixed, generic string for error-level events, `onAPIError: { throw:
+true }` routes a genuinely unexpected failure out to `handleAuthRequest`'s own sanitized boundary
+instead of letting Better Auth's `better-call` transport dependency log it raw through a path no
+`logger` configuration can reach, and `emailAndPassword.minPasswordLength`/`maxPasswordLength` are
+pinned to `8`/`128` instead of left on Better Auth's fallback default.
+
+`createIdentityDrizzleDatabase` (`core/src/identity/database.ts`) also accepts an optional
+`operationTimeoutMs`, applied as both `pg`'s `query_timeout` and `statement_timeout` — bounding a
+hung or slow query, which `connectionTimeoutMs` alone cannot do since it only bounds establishing
+the connection. `apps/api` sets both timeouts explicitly (see [API](api.md)); an invalid value is
+rejected the same sanitized way an invalid connection string already is.
+
 ## What is not operational yet
 
 No email verification, password recovery, invitation flow, email delivery, social or OAuth