feat(auth): add full-online-only auth security feature gate #587

Context

AWCMS-Mini supports development, production online, and offline/LAN deployment profiles. The full-online auth hardening features in this epic (Turnstile, Google login, SSO, and MFA/TOTP) must not change default local/offline behavior and must not make external providers mandatory for LAN-first operation.

This issue creates the shared feature gate that all follow-up issues depend on.

Objective

Add an auth-specific full-online security gate so online-only authentication features are enabled explicitly and remain disabled by default.

Scope

• Add environment variables:
  • AUTH_ONLINE_SECURITY_ENABLED=false
  • AUTH_ONLINE_SECURITY_PROFILE=disabled
• Allowed AUTH_ONLINE_SECURITY_PROFILE values:
  • disabled
  • full_online
• Add a typed helper, for example:
  • src/lib/auth/online-security-config.ts
• Update config validation:
  • scripts/validate-env.ts
• Update security readiness:
  • scripts/security-readiness.ts
• Update documentation:
  • .env.example
  • docs/awcms-mini/18_configuration_env_reference.md
  • docs/awcms-mini/deployment-profiles.md
  • src/modules/identity-access/README.md if needed

Out of scope

• Cloudflare Turnstile implementation.
• Google login implementation.
• Generic SSO/OIDC implementation.
• MFA/TOTP implementation.
• Any change that makes online auth hardening mandatory for local/offline/LAN deployments.

Acceptance criteria

• Default .env.example remains local/offline compatible and does not require internet or external auth providers.
• If AUTH_ONLINE_SECURITY_ENABLED=false, all online auth hardening features are considered disabled.
• If AUTH_ONLINE_SECURITY_ENABLED=true, AUTH_ONLINE_SECURITY_PROFILE must be full_online; otherwise bun run config:validate fails.
• bun run config:validate passes with default local/offline configuration.
• bun run security:readiness reports online auth hardening as disabled when the gate is off, as an informational result rather than a failure.
• No provider credential is required unless its feature is explicitly enabled by a later issue.

Full-online-only guardrail

• Feature only activates when AUTH_ONLINE_SECURITY_ENABLED=true.
• Feature only activates when AUTH_ONLINE_SECURITY_PROFILE=full_online.
• Local development, offline/LAN, and intranet-only deployments keep current auth behavior.
• No external provider call is made by this issue.
• No secrets are committed or logged.

Technical notes

• Prefer an auth-specific gate instead of changing the global deployment model.
• Do not treat APP_ENV=production as equivalent to full online; offline/LAN can be production-like operationally.
• Follow existing conditional config patterns used by R2, email, public routing, and tenant-domain DNS validation.

Testing checklist

• Unit tests for the config helper.
• Unit tests for env validation with enabled/disabled profiles.
• bun run config:validate.
• bun run security:readiness.
• bun run check.

Dependencies

None. This issue must be implemented before the Turnstile, MFA, Google login, SSO, and auth-policy UI issues.