r-same-local-auth-v1-azure-ad-deferred

R-Same v1 uses local authentication (argon2id + mandatory TOTP + JWT in HttpOnly cookies) because Runwal’s Azure AD infrastructure is not yet complete. Azure AD SSO is deferred to v1.5 with stub interfaces only in v1. Migration path on Azure AD completion: dual-mode → per-user email-match → deprecate local. Do not enable direct Azure AD flows until the Runwal AD work is confirmed done.