feat(auth): harden authentication and add configurable two-factor support

app/Services/Auth/SecurityEventRecorder.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Services\Auth;
+
+use App\Models\User;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Str;
+
+class SecurityEventRecorder
+{
+    /**
+     * Record a security event without credentials, tokens, or session IDs.
+     *
+     * @param  array<string, bool|int|string|null>  $context
+     */
+    public function record(
+        string $event,
+        ?User $user,
+        Request $request,
+        array $context = []
+    ): void {
+        Log::channel(config('auth-ui.security.log_channel'))->notice(
+            'Authentication security event',
+            [
+                'event' => $event,
+                'user_id' => $user?->getKey(),
+                'ip_address' => $request->ip(),
+                'user_agent' => Str::limit((string) $request->userAgent(), 255, ''),
+                ...$context,
+            ]
+        );
+    }
+}