ADR-0003: Auth and Session Model

Status: Accepted

Cookie-based session authentication with CSRF protection. First-run bootstrap creates the admin user. A session is an opaque random token in an HTTP-only cookie, stored hashed in the database. WEIR_SESSION_SECRET signs the CSRF tokens.