"""Identity: app accounts, auth, sessions, handles (SPEC §6.1)."""