feat: add app-level authentication foundation

crates/crank-registry/src/model.rs

@@ -2,7 +2,7 @@ use crank_core::{
     Agent, AgentId, AgentOperationBinding, AgentStatus, AgentVersion, AuthProfile, DescriptorId,
     ExportMode, InvitationToken, InvocationLevel, InvocationLog, InvocationSource, MembershipRole,
     Operation, OperationId, OperationStatus, PlatformApiKey, Protocol, SampleId, UsagePeriod,
-    UsageRollup, User, Workspace, WorkspaceId,
+    UsageRollup, User, UserSessionId, Workspace, WorkspaceId,
 };
 use crank_mapping::MappingSet;
 use crank_schema::Schema;
@@ -55,6 +55,25 @@ pub struct MembershipRecord {
     pub created_at: String,
 }
 
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct WorkspaceMembershipRecord {
+    pub workspace: Workspace,
+    pub role: MembershipRole,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct AuthUserRecord {
+    pub user: User,
+    pub password_hash: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct SessionRecord {
+    pub session_id: UserSessionId,
+    pub user: User,
+    pub memberships: Vec<WorkspaceMembershipRecord>,
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct InvitationRecord {
     pub invitation: InvitationToken,