Authentication bounded context — files at a glance.

Locations

Layer	Path
Domain	internal/domain/auth/
Application	internal/application/auth/ — start with facade.go (Service)
HTTP	handler/auth_handler.go (+ account / mfa / oauth)
GoUI	controller_public_auth.go, account MFA
Infra	infrastructure/security, infrastructure/oauth
Wiring	wire_auth.go → authService (API) + authServiceWeb (panel OAuth)

Application

File	Role
facade.go	Transport facade: Login, Session, MFA, OAuth, password, email
service.go	LoginHandler (CQRS)
session.go	Token session
password.go / verify.go / mfa.go / oauth.go	Other use cases

End-to-end (login)

1. Transport → Service.Login
2. LoginHandler.Handle
3. SessionManager issues tokens

Details: AUTH.md, READING.md.