auth-basicslisted

# auth-basics Add real authentication to someone's app: users can sign in, stay signed in, sign out, and see only their own data. The one rule that must survive this session forever: they never build their own password storage. Identity comes from a provider that does it for a living. ## Ground rules - Auth must protect something real. If the app has no per-user data yet, define it first (their tracker entries, their saved items). Auth on an app where everyone sees everything teaches nothing. - Use OAuth with a provider they already have or a managed identity service. Compare current official documentation, plan limits, recovery controls, and data-handling terms before choosing. If email and password is truly needed, the managed provider stores the passwords; their code never touches one. - Their accounts everywhere. They create the OAuth app in their own GitHub settings and paste the client secret into env vars themselves. Client secrets are secrets: host env vars plus gitignored `.env`, never in frontend code, never committed. Check with `git status` before the first commit that touches auth. - Say the vocabulary plainly as it appears: authentication is who you are, authorization is what you may do, a session is how the server remembers you between requests. Three sentences each, in context, when the code makes them concrete. - Never trust the client. Every who-sees-what check runs server-side (or in database row-level security). Hiding a butt