- core/security: argon2 + JWT; deps: get_current_user/require_roles/pagination
- models: User/Account/AuditLog + initial migration + seed
- services: auth, accounts (RBAC visibility + audit + soft delete), audit helper
- api/v1: auth(login/me), accounts CRUD; schemas; 16 tests (RBAC matrix) green
- docs cleanup: slim CLAUDE.md, CONTRIBUTING.md, .claude/rules/; migrations excluded from ruff

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>