A small, auditable proof bundle covering registration, login/logout, bcrypt password hashing, server-side sessions, optional JWTs, and CSRF enforcement.
The bundle contains no wallet, API key, user credential, or payment behavior.