fix: single identity owner, hardened recovery/throttling, firestore parity, release gate

[tnramalho]

Summary

Closes the open review findings from the four-PR stack (#34/#36/#37/#35) as one reviewable slice on top of agent/rockets-auth-hardening. Every fix is the "best-for-the-case" option agreed during triage, not the cheapest patch. Three cold-review rounds (fresh agents, no context) ran against the diff; their findings are folded in.

What changed, by area

Auth composition — single identity owner + enforced boundary

• AuthBootstrap splits into identity (the persistence the whole adapter chain authenticates into — at most one owner per app) and contributes (guard preferences that may coexist). Two owners, or ownership sliced across integrations, now throw at composition naming the adapters.
• Contributed identity.resources are folded into the app's resources[]: the same reference is skipped (idempotent), the same entity with a different config throws naming both sides — instead of the opaque registered twice boot failure a migrating app used to hit.
• The server strips identity/contributes before handing bootstraps to core; RocketsCoreModule now rejects a bootstrap that still carries them, so core never silently drops integration-owned defaults.
• Guard invariant (from the base branch) retained: a contributed enableGlobalGuard: false is honored only with a declared replacement (providesAppGuard) or an explicit app opt-out — otherwise it fails loudly.

Auth recovery + throttling

• Password/login recovery respond immediately and run notification work as a logged floating promise. Uniform response timing removes the account-enumeration side channel; a slow mailer no longer blocks the request; previously-swallowed errors are logged with context.
• The app-wide APP_GUARD throttler is replaced by a guard scoped to the auth-owned public routes (signup, login, recovery, otp, invitation acceptance) — the library no longer rate-limits the host app's own routes.
• Throttling runs on two dimensions at once: a coarse per-IP ceiling (1000/min, the prior default — account rotation cannot exceed it) plus fine per-(ip, account) limits, so an attacker only ever throttles themselves and cannot lock a victim out of login. throttling: false disables both.

Firestore repository parity

• firestoreValuesEqual: NaN matches NaN (the server compiles == NaN to the IS_NAN unary filter) and +0 === -0 — verified against @google-cloud/firestore.
• compareStrings compares by code points (UTF-8 byte order), matching server sort for astral characters.
• getAll is chunked (300/batch): id lists over 500 work again instead of throwing.
• Duplicate-id create() throws one typed FirestoreDuplicateIdException from the backend contract (both backends), extending RepositoryQueryException so the permeator maps it to 409, not a generic 500.

Release tooling

• verify-package-artifacts.mjs validates every main/types/exports/bin/files target against the npm pack --dry-run tarball (plus a source-path guard, since npm auto-includes main even from src/).
• firebase-tools leaves root devDependencies (~398 packages); the emulator runs via pinned npx in one place, and SKIP_EMULATOR skips it locally (never in CI).
• release-readiness.yml keeps only the gates ci-pr-test does not already run.
• Stale rule docs fixed (deleted swagger.json, vitest .ts → .mts).

Reviewer notes / decisions worth confirming

1. throttling: false and the per-IP ceiling — a consumer who passes a custom throttling array without a getTracker on their own ip entry loses the volume ceiling (their config choice). Only the built-in default is protected.
2. Recovery is fire-and-forget — in-flight notification work is lost on a process crash; this is the deliberate timing-attack mitigation, and why the flow e2e now polls.
3. release-readiness on push to main now runs only the gates, not unit/e2e (those ran at PR time via ci-pr-test).
4. Authenticated CRUD routes (admin roles, user metadata) are no longer blanket-throttled — they sit behind auth; only the public auth surface is rate-limited.

Verification

• yarn build, yarn typecheck:spec, yarn test (642), yarn test:e2e (169), yarn lint — all green.
• The intermittent 2-suite e2e flake (password used too recently / rotating victim) is the documented host memory-pressure pattern (CHANGELOG.md), confirmed by a clean 169/169 re-run — no assertions weakened.
• Three cold-review rounds; every confirmed finding fixed (fail-open coverage on signup/invitation, per-IP ceiling, an inverted NaN premise, stale docs, under-asserted test).

🤖 Generated with Claude Code