Merge latest main and add phased auth roadmap

[Copilot]

This syncs the branch with the latest main and resolves the resulting route-registry conflict. It also adds a repo-specific auth roadmap that reflects Ottabase’s current auth surface and the highest-value next steps for a production SaaS framework.

• Merge sync

  • Merged latest origin/main into this branch
  • Resolved the conflict in apps/ottabase-template-app-tanstack/worker/routes/router.ts
  • Preserved both:
    • the existing account-security route wiring from this branch
    • the newer blog/category/series route wiring introduced on main

• Auth roadmap

  • Added ROADMAP_AUTH.MD at the repo root
  • Frames auth work around Ottabase’s actual architecture:
    • @ottabase/auth as the reusable core
    • app layer as thin product/UI glue
  • Organizes next work into clear phases:
    • hardening current auth flows
    • completing account security UX
    • making passkeys first-class in sign-in
    • organization-aware policy controls
    • package/docs polish

• Priority direction captured in the roadmap

  • Encrypt MFA secrets at rest
  • Add recovery codes
  • Add step-up auth for sensitive actions
  • Add session/device visibility and revocation
  • Make passkey-first login a first-class path
  • Support safe email change and provider linking
  • Expand auth/security audit coverage

## Recommended Priority Order

1. Encrypt TOTP secrets at rest
2. Recovery codes
3. Step-up auth for sensitive actions
4. Session/device management
5. Passkey-first login button and autofill UX
6. Email change flow
7. Auth audit event expansion
8. Provider linking/unlinking

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.