Review stale auth production follow-up plan against current auth plugin roadmap

[intel352]

Cleanup found local branch docs/auth-plugin-followups containing docs/plans/2026-04-26-auth-production-followups-design.md and implementation plan. The branch was never merged.

The plan covers Twilio Verify send/check steps, WebAuthn/passkey config alias alignment, email-code composition boundaries, TOTP recovery-code primitives, BMW-specific default removal, and magic-link signature semantics.

Needed outcome:
Review these planned auth production follow-ups against the current multisite/admin auth requirements. Promote still-relevant items into current issues/plans, especially passkey/SSO/account-management related work, and discard obsolete BMW-specific items.

[intel352]

Opened PR #55 with a current production follow-up audit: passkey/OAuth/TOTP/bootstrap primitives are marked against current code, obsolete BMW-specific items are discarded, and the Twilio boundary is documented as host/provider-owned rather than direct core-auth side effects: #55. CI is green; Copilot comments were addressed and resolved; the PR is waiting on required human review.