refactor(rules): group focused security rules

shared/rules/security/references/auth.md

@@ -0,0 +1,8 @@
+# Authentication and authorization security
+
+* Use established authentication standards and password hashing; never store plaintext or reversibly encrypted passwords.
+* Enforce authorization server-side for every sensitive operation and verify resource ownership and tenant boundaries.
+* Use least-privilege roles, short-lived sessions or tokens where supported, and invalidate credentials after sensitive account changes.
+* Validate token issuer, audience, signature, and expiry before trusting claims.
+* Protect authentication and privileged actions against brute force and privilege escalation.
+* Test unauthenticated, unauthorized, cross-user, and cross-tenant access paths.