docs(auth): define authentication security policy

[rd-code-23]

Summary

• record the authentication security policy in ADR 0002
• define the seven-day fixed session lifetime and cookie settings
• define credentialed CORS, synchronizer-token CSRF, trusted-proxy, and safe redirect rules
• align architecture, requirements, and contributor guidance

Why

Authentication middleware needs explicit security-sensitive defaults before implementation begins. This keeps runtime behavior intentional across local and production environments.

Validation

• git diff --check
• pnpm exec prettier --check AGENTS.md docs/architecture.md docs/requirements.md docs/decisions/0002-authentication-security-policy.md

The repository-wide formatting check still reports a pre-existing formatting issue in .github/workflows/ci.yml, which this pull request does not modify.

Closes #4