Add admin identity module: better-auth, per-app permissions, invitations (#12)

Reviewed-on: #12
Co-authored-by: Patrick Müller <mail@pmueller.me>
Co-committed-by: Patrick Müller <mail@pmueller.me>

DEFERRED_SECURITY.md

@@ -32,6 +32,13 @@ Currently any active user can edit, move, or delete any event regardless of who
 
 ## 3. Activation token has no expiry
 
+> **Superseded for new accounts (2026-09-05).** The admin module
+> (`src/models/admin/`) replaced account creation for the feedback, tickets and admin
+> apps: accounts now come from `invitations`, whose tokens expire after 7 days and are
+> stored only as a SHA-256 hash. The item below still stands for the legacy calendar
+> `users` table, which the admin module deliberately left alone - see
+> `docs/calendar-auth-migration.md`.
+
 **File:** `src/models/calendar/users/users.service.ts` — `createUser` / `activateUser`
 
 The email activation link is valid indefinitely. Acceptable for a small, trusted userbase.
@@ -45,6 +52,10 @@ The email activation link is valid indefinitely. Acceptable for a small, trusted
 
 ## 4. Password reset token has no expiry
 
+> **Superseded for new accounts (2026-09-05).** Password resets for admin-module accounts
+> go through better-auth, whose reset tokens expire after one hour. As with item 3, the
+> text below still applies to the legacy calendar `users` table.
+
 **File:** `src/models/calendar/users/users.service.ts` — `initiatePasswordReset` / `finalizePasswordReset`
 
 The reset token stored in `pw_reset_token_hash` never expires. Acceptable for a small, trusted userbase.