feat(auth): replace hand-rolled auth with Ory Kratos — phase 2 backend

Delegates all credential management (login, register, password reset,
email verification, social sign-in) to Ory Kratos. The Go API now acts
as a resource server: the new KratosAuth middleware validates sessions
against the Kratos whoami endpoint, writes the local User mirror into
Echo context, and all existing domain handlers continue working
unchanged. Hand-rolled token auth, AuthToken model, apple_auth/
google_auth services, and the auth refresh flow are removed. Tests are
updated to use the fake-token middleware pattern so existing integration
assertions require no rewrite.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/models/models_coverage_test.go

@@ -19,7 +19,7 @@ func setupModelsTestDB(t *testing.T) *gorm.DB {
 		Logger: logger.Default.LogMode(logger.Silent),
 	})
 	require.NoError(t, err)
-	err = db.AutoMigrate(&User{}, &AuthToken{}, &UserProfile{})
+	err = db.AutoMigrate(&User{}, &UserProfile{})
 	require.NoError(t, err)
 	return db
 }
@@ -233,105 +233,6 @@ func TestNotificationType_Constants(t *testing.T) {
 	assert.Equal(t, NotificationType("warranty_expiring"), NotificationWarrantyExpiring)
 }
 
-// === AuthToken model tests ===
-
-func TestAuthToken_BeforeCreate_GeneratesKey(t *testing.T) {
-	db := setupModelsTestDB(t)
-
-	user := &User{
-		Username: "tokenuser",
-		Email:    "token@test.com",
-		Password: "dummy",
-		IsActive: true,
-	}
-	err := db.Create(user).Error
-	require.NoError(t, err)
-
-	token := &AuthToken{UserID: user.ID}
-	err = db.Create(token).Error
-	require.NoError(t, err)
-
-	assert.NotEmpty(t, token.Key)
-	assert.Len(t, token.Key, 64)       // SHA-256 hex hash (audit C1)
-	assert.Len(t, token.Plaintext, 40) // raw 20-byte token, returned to the client
-	assert.False(t, token.Created.IsZero())
-}
-
-func TestAuthToken_BeforeCreate_PreservesExistingKey(t *testing.T) {
-	db := setupModelsTestDB(t)
-
-	user := &User{
-		Username: "tokenuser",
-		Email:    "token@test.com",
-		Password: "dummy",
-		IsActive: true,
-	}
-	err := db.Create(user).Error
-	require.NoError(t, err)
-
-	existingKey := "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"
-	token := &AuthToken{
-		Key:    existingKey,
-		UserID: user.ID,
-	}
-	err = db.Create(token).Error
-	require.NoError(t, err)
-
-	assert.Equal(t, existingKey, token.Key)
-}
-
-func TestGetOrCreateToken_CreatesNew(t *testing.T) {
-	db := setupModelsTestDB(t)
-
-	user := &User{
-		Username: "newtoken",
-		Email:    "newtoken@test.com",
-		Password: "dummy",
-		IsActive: true,
-	}
-	err := db.Create(user).Error
-	require.NoError(t, err)
-
-	token, err := GetOrCreateToken(db, user.ID)
-	require.NoError(t, err)
-	assert.NotEmpty(t, token.Key)
-	assert.Equal(t, user.ID, token.UserID)
-}
-
-func TestGetOrCreateToken_ReturnsExisting(t *testing.T) {
-	db := setupModelsTestDB(t)
-
-	user := &User{
-		Username: "existingtoken",
-		Email:    "existingtoken@test.com",
-		Password: "dummy",
-		IsActive: true,
-	}
-	err := db.Create(user).Error
-	require.NoError(t, err)
-
-	token1, err := GetOrCreateToken(db, user.ID)
-	require.NoError(t, err)
-
-	token2, err := GetOrCreateToken(db, user.ID)
-	require.NoError(t, err)
-
-	assert.Equal(t, token1.Key, token2.Key)
-}
-
-// === User model additional tests ===
-
-func TestUser_SetPassword_And_CheckPassword_Integration(t *testing.T) {
-	user := &User{}
-	err := user.SetPassword("Password123")
-	require.NoError(t, err)
-
-	assert.True(t, user.CheckPassword("Password123"))
-	assert.False(t, user.CheckPassword("WrongPassword"))
-	assert.False(t, user.CheckPassword(""))
-	assert.False(t, user.CheckPassword("password123")) // case sensitive
-}
-
 // === Task model additional tests ===
 
 func TestTask_IsOverdue_CancelledNotOverdue(t *testing.T) {
@@ -565,31 +466,6 @@ func TestGetDefaultProLimits(t *testing.T) {
 	assert.Nil(t, limits.DocumentsLimit)
 }
 
-// === ConfirmationCode additional tests ===
-
-func TestConfirmationCode_TableName(t *testing.T) {
-	cc := ConfirmationCode{}
-	assert.Equal(t, "user_confirmationcode", cc.TableName())
-}
-
-// === PasswordResetCode additional tests ===
-
-func TestPasswordResetCode_TableName(t *testing.T) {
-	prc := PasswordResetCode{}
-	assert.Equal(t, "user_passwordresetcode", prc.TableName())
-}
-
-// === Social Auth TableName tests ===
-
-func TestAppleSocialAuth_TableName(t *testing.T) {
-	a := AppleSocialAuth{}
-	assert.Equal(t, "user_applesocialauth", a.TableName())
-}
-
-func TestGoogleSocialAuth_TableName(t *testing.T) {
-	g := GoogleSocialAuth{}
-	assert.Equal(t, "user_googlesocialauth", g.TableName())
-}
 
 // === BaseModel tests ===