feat(auth): replace hand-rolled auth with Ory Kratos — phase 2 backend

Delegates all credential management (login, register, password reset,
email verification, social sign-in) to Ory Kratos. The Go API now acts
as a resource server: the new KratosAuth middleware validates sessions
against the Kratos whoami endpoint, writes the local User mirror into
Echo context, and all existing domain handlers continue working
unchanged. Hand-rolled token auth, AuthToken model, apple_auth/
google_auth services, and the auth refresh flow are removed. Tests are
updated to use the fake-token middleware pattern so existing integration
assertions require no rewrite.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/integration/security_regression_test.go

@@ -6,9 +6,11 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"sync"
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/labstack/echo/v4"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -35,6 +37,48 @@ type SecurityTestApp struct {
 	Router              *echo.Echo
 	SubscriptionService *services.SubscriptionService
 	SubscriptionRepo    *repositories.SubscriptionRepository
+	tokenStore          map[string]*models.User
+	tokenStoreMu        sync.RWMutex
+}
+
+// fakeAuthMiddleware returns an Echo middleware that authenticates requests using
+// the in-process tokenStore instead of calling the real Kratos session endpoint.
+func (app *SecurityTestApp) fakeAuthMiddleware() echo.MiddlewareFunc {
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			ah := c.Request().Header.Get("Authorization")
+			if ah == "" {
+				return apperrors.Unauthorized("error.not_authenticated")
+			}
+			tok := ah
+			if len(ah) > 6 && ah[:6] == "Token " {
+				tok = ah[6:]
+			} else if len(ah) > 7 && ah[:7] == "Bearer " {
+				tok = ah[7:]
+			}
+			app.tokenStoreMu.RLock()
+			user, ok := app.tokenStore[tok]
+			app.tokenStoreMu.RUnlock()
+			if !ok {
+				return apperrors.Unauthorized("error.not_authenticated")
+			}
+			c.Set("auth_user", user)
+			c.Set("auth_token", tok)
+			return next(c)
+		}
+	}
+}
+
+// registerAndLoginSec creates a user directly in the DB and returns a fake token
+// that the fakeAuthMiddleware will accept. No HTTP register/login calls are made.
+func (app *SecurityTestApp) registerAndLoginSec(t *testing.T, username, email, _ string) (string, uint) {
+	t.Helper()
+	user := testutil.CreateTestUser(t, app.DB, username, email, "")
+	tok := uuid.NewString()
+	app.tokenStoreMu.Lock()
+	app.tokenStore[tok] = user
+	app.tokenStoreMu.Unlock()
+	return tok, user.ID
 }
 
 func setupSecurityTest(t *testing.T) *SecurityTestApp {
@@ -78,27 +122,25 @@ func setupSecurityTest(t *testing.T) *SecurityTestApp {
 	notificationHandler := handlers.NewNotificationHandler(notificationService)
 	subscriptionHandler := handlers.NewSubscriptionHandler(subscriptionService, nil)
 
-	// Create router with real middleware
+	app := &SecurityTestApp{
+		DB:                  db,
+		SubscriptionService: subscriptionService,
+		SubscriptionRepo:    subscriptionRepo,
+		tokenStore:          make(map[string]*models.User),
+	}
+
+	// Create router with fake auth middleware
 	e := echo.New()
 	e.Validator = validator.NewCustomValidator()
 	e.HTTPErrorHandler = apperrors.HTTPErrorHandler
 
 	e.Use(middleware.TimezoneMiddleware())
 
-	// Public routes
-	auth := e.Group("/api/auth")
-	{
-		auth.POST("/register", authHandler.Register)
-		auth.POST("/login", authHandler.Login)
-	}
-
 	// Protected routes
-	authMiddleware := middleware.NewAuthMiddleware(db, nil)
 	api := e.Group("/api")
-	api.Use(authMiddleware.TokenAuth())
+	api.Use(app.fakeAuthMiddleware())
 	{
 		api.GET("/auth/me", authHandler.CurrentUser)
-		api.POST("/auth/logout", authHandler.Logout)
 
 		residences := api.Group("/residences")
 		{
@@ -146,42 +188,8 @@ func setupSecurityTest(t *testing.T) *SecurityTestApp {
 		}
 	}
 
-	return &SecurityTestApp{
-		DB:                  db,
-		Router:              e,
-		SubscriptionService: subscriptionService,
-		SubscriptionRepo:    subscriptionRepo,
-	}
-}
-
-// registerAndLoginSec registers and logs in a user, returns token and user ID.
-func (app *SecurityTestApp) registerAndLoginSec(t *testing.T, username, email, password string) (string, uint) {
-	// Register
-	registerBody := map[string]string{
-		"username": username,
-		"email":    email,
-		"password": password,
-	}
-	w := app.makeAuthReq(t, "POST", "/api/auth/register", registerBody, "")
-	require.Equal(t, http.StatusCreated, w.Code, "Registration should succeed for %s", username)
-
-	// Login
-	loginBody := map[string]string{
-		"username": username,
-		"password": password,
-	}
-	w = app.makeAuthReq(t, "POST", "/api/auth/login", loginBody, "")
-	require.Equal(t, http.StatusOK, w.Code, "Login should succeed for %s", username)
-
-	var loginResp map[string]interface{}
-	err := json.Unmarshal(w.Body.Bytes(), &loginResp)
-	require.NoError(t, err)
-
-	token := loginResp["token"].(string)
-	userMap := loginResp["user"].(map[string]interface{})
-	userID := uint(userMap["id"].(float64))
-
-	return token, userID
+	app.Router = e
+	return app
 }
 
 // makeAuthReq creates and sends an HTTP request through the router.