//! Identity & Access — JWT, signed cookies, server-side sessions, OAuth2, guards.
//!
//! | Submodule | Responsibility |
//! |------------|--------------------------------------------------------------|
//! | [`jwt`] | Sign / decode / validate JSON Web Tokens (`JwtService`) |
//! | [`cookie`] | HMAC-SHA256 signed cookies (`CookieService`) |
//! | [`session`]| Server-side session store abstraction (`SessionManager`) |
//! | [`oauth`] | OAuth2 Authorization Code + PKCE provider trait |
//! | [`guards`] | Request guards (`JwtAuthGuard`, `RoleGuard`, …) |
//! | [`extract`]| The single credential-extraction pipeline used by every |
//! | | request boundary (HTTP, plugin routes, WebSocket handshake) |
// `crate::auth::{JwtService, JwtConfig, decode_bearer_token}` keeps working —
// jwt.rs is the direct descendant of the old src/auth.rs.
pub use *;