feat: complete registration invitation and auth redesign

server/auth/auth.go

@@ -278,7 +278,7 @@ type AuthHandler interface {
 	// continue the authentication process to the next step, or return an error code.
 	// The remoteAddr (i.e. the IP address of the client) can be used by custom authenticators for
 	// additional validation. The stock authenticators don't use it.
-	// store.Users.GetAuthRecord("scheme", "unique")
+	// The selected handler resolves its account through the tenant-scoped auth store.
 	// Returns: user auth record, challenge, error.
 	Authenticate(ctx AuthContext, secret []byte) (*Rec, []byte, error)