// Package security holds the pure cryptographic and authorization primitives for the auth module.
//
// Everything here is deliberately free of database and network access so it runs under the standard
// unit suite (make test) with no live Postgres. The DB backed flows (sessions, credentials, MFA
// enrollment) live in internal/modules/auth and call into these helpers.
//
// Crypto posture: every primitive routes through the Go standard library so that under a
// GOFIPS140=v1.0.0 build it executes inside the validated module (CMVP #5247). The password and
// recovery code KDF is PBKDF2 with HMAC SHA 256 (SP 800-132), chosen over argon2 and bcrypt because
// those KDFs sit outside the FIPS boundary. TOTP is implemented here on crypto/hmac rather than a
// third party library so there is no external crypto to re verify under fips140=on. Session tokens
// are opaque random values stored only as a SHA 256 hash.
package security