docs(security): strengthen auth guidance

shared/rules/security/references/auth.md

@@ -1,8 +1,11 @@
 # Authentication and authorization security
 
 * Use established authentication standards and password hashing; never store plaintext or reversibly encrypted passwords.
+* Use a maintained password-hashing scheme configured for the deployment environment. Never create password schemes or reduce work factors merely to improve latency.
 * Enforce authorization server-side for every sensitive operation and verify resource ownership and tenant boundaries.
-* Use least-privilege roles, short-lived sessions or tokens where supported, and invalidate credentials after sensitive account changes.
-* Validate token issuer, audience, signature, and expiry before trusting claims.
-* Protect authentication and privileged actions against brute force and privilege escalation.
-* Test unauthenticated, unauthorized, cross-user, and cross-tenant access paths.
+* Deny by default and check authorization on every request, including background jobs and alternate API paths. Do not trust role or identity values supplied by clients.
+* Use least-privilege roles, short-lived sessions or tokens, secure renewal and revocation, and invalidate credentials after password, recovery, or privilege changes.
+* Validate token algorithm, issuer, audience, signature, expiry, and any required not-before or key identifier claims before trusting it. Reject unexpected algorithms and malformed claims.
+* Protect login, recovery, reset, MFA, and privileged actions against brute force, enumeration, replay, CSRF, and privilege escalation.
+* Store session identifiers securely; rotate them after authentication or privilege changes and invalidate them on logout or account recovery.
+* Test unauthenticated, unauthorized, cross-user, cross-tenant, expired-token, revoked-session, and recovery-flow paths.