Authentication
Better-Auth + passkeys + 2FA
Email/password, passkey, and TOTP flows are wired with Prisma, HaveIBeenPwned checks, device authorization, and secure session caching.
- Session cache with root bypass
- Automatic HaveIBeenPwned password screening
- Device codes for low-input hardware