"""Auth boundary module — sole place that talks OIDC / sessions (ADR-0001, §2.3)."""