Auth, sessions, CSRF

TODO

Document sessions as digests, argon2id via Bun.password, and CSRF published once on the body. Fill this page on the next pass — prefer expanding this stub over adding a new sidebar section.