# Auth Module

Registration, login, social auth (Google/Apple), token management.

## Responsibilities
- User registration (email/password and social)
- Login / logout
- Token management (Sanctum)
- OAuth callback handling (Socialite)
- Password reset

## Key Rules
- Social-only users have nullable password
- OAuth tokens are never stored in our DB — only the provider user ID
- All auth endpoints are rate-limited separately from general API