feat(auth): harden authentication and add configurable two-factor support

.env.example

@@ -13,7 +13,11 @@ APP_MAINTENANCE_DRIVER=file
 
 PHP_CLI_SERVER_WORKERS=12
 
-BCRYPT_ROUNDS=12
+HASH_DRIVER=argon2id
+HASH_VERIFY=true
+ARGON_MEMORY=65536
+ARGON_THREADS=1
+ARGON_TIME=4
 
 LOG_CHANNEL=stack
 LOG_STACK=single
@@ -30,6 +34,9 @@ DB_PASSWORD=password
 SESSION_DRIVER=database
 SESSION_LIFETIME=120
 SESSION_ENCRYPT=false
+SESSION_SECURE_COOKIE=false
+SESSION_HTTP_ONLY=true
+SESSION_SAME_SITE=lax
 SESSION_PATH=/
 SESSION_DOMAIN=null
 
@@ -69,6 +76,10 @@ AUTH_ENABLE_REMEMBER_ME=true
 AUTH_ENABLE_EMAIL_VERIFICATION=false
 AUTH_ENABLE_TWO_FACTOR=false
 AUTH_REQUIRE_TWO_FACTOR=false
+AUTH_TWO_FACTOR_CHALLENGE_TIMEOUT=300
+AUTH_ABSOLUTE_SESSION_LIFETIME=28800
+AUTH_SECURITY_LOG_CHANNEL=stack
+# In production, set SESSION_ENCRYPT=true and SESSION_SECURE_COOKIE=true.
 
 # Auth Redirects
 # AUTH_REDIRECT_LOGIN=/dashboard