As a founder, it's tempting to have an assistant generate auth and move on. I tried it. The happy path worked right away. What it didn't include unless I asked: lockout, enumeration-safe errors, session revocation after a password change, refresh-token…