Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/auth/password_test.go

@@ -0,0 +1,59 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestHashPasswordRejectsShort(t *testing.T) {
+	t.Parallel()
+	_, err := HashPassword("short")
+	if err == nil {
+		t.Fatal("expected error for password shorter than 8 characters")
+	}
+}
+
+func TestHashPasswordAndVerifyRoundTrip(t *testing.T) {
+	t.Parallel()
+	const password = "correct-horse-battery"
+	encoded, err := HashPassword(password)
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+	if !strings.HasPrefix(encoded, "$argon2id$") {
+		t.Fatalf("unexpected encoding prefix: %q", encoded)
+	}
+	ok, err := VerifyPassword(encoded, password)
+	if err != nil {
+		t.Fatalf("VerifyPassword: %v", err)
+	}
+	if !ok {
+		t.Fatal("expected password to verify")
+	}
+	ok, err = VerifyPassword(encoded, "wrong-password")
+	if err != nil {
+		t.Fatalf("VerifyPassword wrong: %v", err)
+	}
+	if ok {
+		t.Fatal("expected wrong password to fail verification")
+	}
+}
+
+func TestVerifyPasswordInvalidFormat(t *testing.T) {
+	t.Parallel()
+	_, err := VerifyPassword("not-a-hash", "anything12")
+	if err == nil {
+		t.Fatal("expected invalid format error")
+	}
+}
+
+func TestRandomTokenLength(t *testing.T) {
+	t.Parallel()
+	tok, err := RandomToken(24)
+	if err != nil {
+		t.Fatalf("RandomToken: %v", err)
+	}
+	if len(tok) != 48 {
+		t.Fatalf("expected hex length 48, got %d (%q)", len(tok), tok)
+	}
+}