Verify M2/M3 implementation, fix regressions against M0/M1

Regressions fixed:
- gateway/src/worker.rs: missing session_manager field in AuthState (M3 regression)
- gateway/src/main.rs: same missing field in monolithic gateway
- storage/src/handlers.rs: removed unused validate_role (now handled by RlsTransaction)

M2 Storage Pillar — verified complete:
- StorageBackend trait with full API (put/get/delete/copy/head/list/multipart)
- AwsS3Backend implementation with streaming get_object
- StorageMode enum (Cloud/SelfHosted) in Config
- All routes: CRUD buckets, CRUD objects, copy, move, sign, public URL, health
- Bucket constraints: file_size_limit + allowed_mime_types enforced on upload
- TUS resumable uploads with S3 multipart (5MB chunking)
- Image transforms run via spawn_blocking
- docker-compose.pillar-storage.yml, templates/storage-node.yaml
- Shared Docker network on all pillar compose files

M3 Auth Completeness — verified complete:
- POST /logout revokes refresh tokens + Redis sessions
- GET /settings returns provider availability
- POST /magiclink with hashed token storage
- DELETE /user soft-delete with token revocation
- Recovery flow accepts new password
- Email change requires re-verification via token
- OAuth callback redirects with fragment tokens
- MFA verify returns aal2 JWT with amr claims
- MFA challenge validates factor ownership
- SessionManager wired into login/logout
- GET /sessions returns active sessions
- Configurable ACCESS_TOKEN_LIFETIME
- Claims model extended with session_id, aal, amr

Tests: 62 passed, 0 failed, 11 ignored (external services)
Warnings: 0
Made-with: Cursor

auth/src/models.rs

@@ -26,6 +26,7 @@ pub struct User {
     pub recovery_token: Option<String>,
     pub email_change_token_new: Option<String>,
     pub email_change: Option<String>,
+    pub deleted_at: Option<DateTime<Utc>>,
 }
 
 #[derive(Debug, Deserialize, Validate)]
@@ -55,7 +56,7 @@ pub struct AuthResponse {
 
 #[derive(Debug, Serialize, Deserialize, FromRow)]
 pub struct RefreshToken {
-    pub id: i64, // BigSerial
+    pub id: i64,
     pub token: String,
     pub user_id: Uuid,
     pub revoked: bool,
@@ -73,9 +74,9 @@ pub struct RecoverRequest {
 
 #[derive(Debug, Deserialize)]
 pub struct VerifyRequest {
-    pub r#type: String, // signup, recovery, magiclink, invite
+    pub r#type: String,
     pub token: String,
-    pub password: Option<String>, // for recovery flow
+    pub password: Option<String>,
 }
 
 #[derive(Debug, Deserialize, Validate)]
@@ -86,3 +87,18 @@ pub struct UserUpdateRequest {
     pub password: Option<String>,
     pub data: Option<serde_json::Value>,
 }
+
+#[derive(Debug, Serialize, Deserialize, FromRow)]
+pub struct MfaChallenge {
+    pub id: Uuid,
+    pub factor_id: Uuid,
+    pub created_at: DateTime<Utc>,
+    pub verified_at: Option<DateTime<Utc>>,
+    pub ip_address: Option<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Clone)]
+pub struct AmrEntry {
+    pub method: String,
+    pub timestamp: usize,
+}