## Why

Authentication is a dependent feature chain outside `master`. The refresh-only fix cannot work on its own because `master` lacks the login, session, permission, and database code it needs.

## What Changes

- Integrate the authentication foundation, session/CSRF correction, login UI, and refresh redirect fix on a branch based on current `master`.
- Retain current device, phone, and WeCom asset behavior while adding authentication and page permissions.
- Exclude historical source-branch OpenSpec records; retain only this integration plan.
- **BREAKING**: management pages require a valid authenticated session after release.

## Capabilities

### New Capabilities

- `authentication-master-integration`: safe integration, verification, and release readiness for the full authentication feature.

### Modified Capabilities

<!-- None. -->

## Impact

- Backend authentication, authorization, CSRF protection, system-user data, and the related migration.
- Frontend login, startup routing, protected asset workspaces, and refresh behavior.
- Release readiness requires a valid administrator account and matching frontend/backend artifacts.
