Harden auth recovery, abuse controls, and runtime

[capybaracplusplus]

Summary

• complete runtime dynamic-config boundaries for auth and email outbox policies
• add password reset request/confirm flows with HMAC-hashed one-time tokens and session revocation
• add persistent PostgreSQL rate limits for sign-in, verification, resend, and password reset
• make attempt recording and token/code consumption atomic under concurrent requests
• add ownership leases to the transactional email outbox so stale workers cannot overwrite reclaimed jobs
• add private liveness/readiness endpoints with PostgreSQL, schema, migration, and dynamic-config checks
• standardize the CLion devcontainer and production image on non-root users
• update OpenAPI, deployment/security documentation, and CI release gates

Why

The previous implementation had environment ambiguity between host and container builds, root-only functional tests, and race windows around rate limits, one-time credentials, and outbox job reclamation. This change makes those state transitions transactional, gives the service explicit operational health contracts, and establishes a reproducible portfolio-quality build and test baseline.

Validation

• cmake --build build-debug --target smirkly-auth smirkly-auth_unittest --parallel 1
• ctest --test-dir build-debug --output-on-failure (unit suite and 29 functional scenarios)
• cmake --preset release
• cmake --build build-release --target smirkly-auth --parallel 2
• all 11 migrations verified with an isolated PostgreSQL up -> down -> up cycle
• live smoke test returned readiness 200 with schema version 11; health endpoints returned 404 on the public listener
• install artifact contains only the release binary and static_config.prod.yaml
• changed C++ sources pass clang-format --dry-run --Werror; YAML and local OpenAPI references validate

Operational notes

Email delivery remains intentionally at-least-once: an SMTP success followed by a database failure may produce a duplicate delivery. Sign-up abuse protection still requires an edge/gateway limiter until a shared application-level sign-up limiter is added.