ADR 0003 — Auth behind a thin interface

The decision was to reach authentication only through a thin Auth interface, so the backing implementation could be swapped — or extended with OAuth, two-factor, or a hosted provider — without touching route handlers, middleware, the setup wizard, or the admin API client. Auth is hand-rolled behind src/shared/auth/, exposed through its index barrel; application code imports from the barrel and never reaches into the backing file.

When the Phase 1 auth surface shipped, this wrapping principle and the concrete implementation (Argon2id hashing, D1-backed sessions, sliding expiry, rate-limited login) were recorded together in ADR 0009. Rather than maintain two overlapping records, the substance lives in ADR 0009 and this one points there.