auth-session--oauth2-scaffolderlisted

# Auth Session & OAuth2 Scaffolder ## 1. System Architecture & Prerequisites - Node.js >= 18 LTS (runtime), npm >= 9, TypeScript >= 5.5, `ts-node-dev@^2.0.0` for watch mode. - Core deps: `express@^4.19.2`, `argon2@^0.41.1` (Argon2id), `jsonwebtoken@^9.0.2`, `cookie-parser@^1.4.6`, `redis@^4.7.0`, `pg@^8.12.0`, `nodemailer@^6.9.14`, `passport@^0.7.0`, `passport-google-oauth20@^2.0.0`, `passport-github2@^0.1.12`, `zod@^3.23.8`, `helmet@^7.1.0`, `cors@^2.8.5`, `dotenv@^16.4.5`. - Infrastructure: PostgreSQL >= 14 (schema auto-created by `initDb()`), Redis >= 6 (refresh-token blacklist + optional revocation state). - `argon2` ships prebuilt binaries via node-pre-gyp; if a native build is forced, a C++ toolchain (Visual Studio Build Tools) is required on Windows or `build-essential` on Linux. - The JWT access secret and refresh secret are hard-required (min 32 chars) by the config loader; the server refuses to boot without them. ## 2. Input/Output Data Contracts ### Request payloads (JSON) - `POST /register` → `{"email": string(email), "password": string(8..72), "displayName": string(1..64)}` → 201 `{success, data:{user, requiresEmailVerification}}`. - `POST /login` → `{"email": string(email), "password": string}` → 200 `{success, data:{user}}` + sets `access_token`/`refresh_token` cookies. - `POST /refresh` (no body) → reads `refresh_token` cookie → rotates token, sets new cookies → 200. - `POST /logout` (no body) → revokes refresh token + clears cookies → 200. - `POST /forgo