Company authentication foundation

FastAPI owns users, companies and identities.
Auth.js owns the browser session and signs JWTs that the API can verify.