docs: bring the wiki up to date with Better Auth, RBAC and SSO
The wiki stopped at 11 July 2026, thirteen days before Auth.js was replaced by
Better Auth, so it described an application that no longer exists. Everything
from the better_auth, add_passkey, rbac_roles, rbac_audit_stepup,
add_sso_provider_and_policy and add_user_invitation_and_forced_password_change
migrations was undocumented.
- Add Authentication and Audit Log pages
- Rewrite Roles and Permissions around the 36-permission model, replacing the
removed ADMIN / VIEWER enum, and document the escalation controls
- Rebuild the API reference from route-permissions.ts, adding the fourteen
endpoints that were missing and splitting read from write permissions
- Correct the stack to Next.js 16 and Better Auth
- Replace AUTH_SECRET / AUTH_URL with BETTER_AUTH_SECRET / BETTER_AUTH_URL and
document encryption key rotation
- Add the ten missing migrations and the identity models to the schema page
- Note that the rate limiter is Postgres-backed, not in-memory
- Drop the work-in-progress banner, completed for v1.0.0
- Add the missing mfa-coverage widget
docs: document risk, MFA, notifications, SIEM, remediation, register
Cover features added after the initial wiki: risk scoring, MFA coverage,
notification channels, SIEM export/push, directory remediation, and the GDPR
exposure register. Update schema, API reference, reports, and breach scanning
for PDF/scheduled delivery, stealer logs, and new models.
docs: add complete project wiki