Bun Auth Gateway

A session-auth gateway assembled entirely from Bun runtime primitives, no auth library and no Redis. Bun.serve routes carry the HTTP surface, req.cookies (Bun.CookieMap) manages sessions with automatic Set-Cookie, Bun.CSRF issues and verifies tokens bound to the session id, and Bun.password (argon2id) hashes credentials with a dummy-hash verify on unknown users so signin timing does not leak which emails exist. A sliding-window rate limiter and a request log live in bun:sqlite. Routes cover signup, login, logout, a session-scoped me, csrf issuance, a CSRF-protected mutation, and an admin log view. Notes the real quirk that Bun.CSRF.verify throws on an empty token rather than returning false, wrapped so any throw reads as invalid.