"""Sign in with BW (Pattern B) — the app's entire auth surface.

    bw_auth.py     the kit port: PKCE, authorize URL, code exchange,
                   id_token verification, logout URL (stdlib-only)
    config.py      env-read policy: APP_ENV, AUTH_DEV_USER (judgment #13)
    session.py     the app's OWN session: short-TTL HMAC-signed cookie
    provision.py   auto-provision zero-capability users rows
    middleware.py  default-deny gate (allowlist = /healthz, /auth/*, assets)

Identity enters the app in exactly one place: a verified id_token in
/auth/callback (app/routers/auth.py). Headers never grant identity
(T-AZ-045).
"""