feat(auth): implement session methods with Payload-backed JWT

Replace NotImplementedError stubs in AuthenticationService with working
implementations: createSession signs a HS256 JWT using Payload's instance
secret, validateSession verifies and decodes the token then looks up the
user, invalidateSession returns a blank cookie with maxAge 0. No external
JWT dependency — uses Node crypto HMAC directly.

Also clarify withAudit/withAnalytics comments: the wrappers intentionally
delegate recording to the use case body (only it knows which fields to
extract), so the TODO was misleading.

packages/core-audit/src/with-audit.ts

@@ -21,11 +21,10 @@ export type Audited<F> = F & { readonly __audited: true };
  * tests).
  */
 export function withAudit<Args extends unknown[], R>(
-  // TODO: wire automated recording from manifest declarations.
-  // `audits[]` declarations. For now, the wrapper exists to:
-  //   (1) require callers to pass the auditLog at bind time (dep is available)
-  //   (2) attach the `__audited` brand so the boot-time assertion can verify
-  //       mutating use cases were bound through the audit-aware path.
+  // The wrapper attaches the brand and ensures the auditLog dependency is
+  // available at bind time. Actual `auditLog.record()` calls live in the
+  // use case body — only the use case knows which fields to extract from
+  // its input/output for the audit entry.
   auditLog: IAuditLog,
   fn: (...args: Args) => Promise<R>,
 ): Audited<(...args: Args) => Promise<R>> {