feat(auth): harden authentication and add configurable two-factor support

config/hashing.php

@@ -0,0 +1,30 @@
+<?php
+
+return [
+    /*
+    |--------------------------------------------------------------------------
+    | Password hashing
+    |--------------------------------------------------------------------------
+    |
+    | Argon2id is the only accepted password algorithm. Strict algorithm
+    | verification prevents hashes created with an unexpected algorithm from
+    | being accepted by this fresh application template.
+    |
+    */
+    'driver' => env('HASH_DRIVER', 'argon2id'),
+
+    'bcrypt' => [
+        'rounds' => env('BCRYPT_ROUNDS', 12),
+        'verify' => env('HASH_VERIFY', true),
+        'limit' => env('BCRYPT_LIMIT', null),
+    ],
+
+    'argon' => [
+        'memory' => env('ARGON_MEMORY', 65536),
+        'threads' => env('ARGON_THREADS', 1),
+        'time' => env('ARGON_TIME', 4),
+        'verify' => env('HASH_VERIFY', true),
+    ],
+
+    'rehash_on_login' => true,
+];