Add initial project files

docs/core/auth/backend.md

@@ -0,0 +1,105 @@
+# Auth Backend
+
+The backend Auth module exposes token-based admin authentication routes.
+
+Source: `apps/backend/app/base_modules/Auth/`
+
+## Routes
+
+| Method | Route          | Controller Method | Auth Required | Purpose                                     |
+| ------ | -------------- | ----------------- | ------------- | ------------------------------------------- |
+| `POST` | `/auth/login`  | `login`           | No            | Verify credentials and create bearer token. |
+| `POST` | `/auth/logout` | `logout`          | Yes           | Invalidate current bearer token.            |
+| `GET`  | `/auth/user`   | `user`            | Yes           | Return current admin and permission slugs.  |
+
+Route file:
+
+```txt
+apps/backend/app/base_modules/Auth/routes.ts
+```
+
+## Request Flow
+
+### Login
+
+```txt
+POST /auth/login
+  -> auth_login_validator
+  -> Admin.findBy('email')
+  -> hash.verify(password)
+  -> Admin.accessTokens.create(admin)
+  -> return { type, token, user }
+```
+
+### Current User
+
+```txt
+GET /auth/user
+  -> auth middleware
+  -> auth.use('api').user
+  -> load roles
+  -> query role_permissions
+  -> return { user, permissions }
+```
+
+## Validation
+
+Login validator:
+
+```txt
+apps/backend/app/base_modules/Auth/validators/auth_login_validator.ts
+```
+
+Current rules:
+
+- `email`: trimmed email string.
+- `password`: trimmed string with minimum length 8.
+
+## Token Guard
+
+Auth config:
+
+```txt
+apps/backend/config/auth.ts
+```
+
+The admin model is configured as the token user provider:
+
+```txt
+apps/backend/app/base_modules/Admin/model/admin.ts
+```
+
+## Response Contracts
+
+Login response consumed by frontend:
+
+```ts
+type LoginResponse = {
+  type: "bearer";
+  token: string;
+  user: unknown;
+};
+```
+
+Current-user response consumed by frontend:
+
+```ts
+type GetUserResponse = {
+  user: {
+    id: number;
+    email: string;
+    firstName: string;
+    lastName: string;
+    status: string;
+    createdAt: string;
+    roles: Array<{ id: number; name: string }>;
+  };
+  permissions: string[];
+};
+```
+
+## Ownership Rules
+
+- Auth backend owns token creation, token invalidation, and current-user response shape.
+- Admin backend owns admin persistence and profile updates.
+- Permission data in `/auth/user` is derived from role-permission rows.