Authentication: Firebase Auth + custom claims.

Shipped: Email/password, magic link, OAuth (Google, Apple). Per-tenant isolation enforced via JWT claims read by Firestore rules.