refactor(ddd)!: harden DDD primitives

[pourdaavar]

Overview

Harden the @rineex/ddd tactical DDD primitives and migrate affected authentication consumers to the new contract.

Scope

• Make entity validation safe and mutation atomic.
• Protect aggregate event recording and validate aggregate ownership.
• Require validated, explicit domain-event metadata and JSON-safe payloads.
• Protect entity creation timestamps from external mutation.
• Migrate authentication aggregates and domain events.
• Add usage, migration, and agent guidance documentation.

Breaking changes

• Entity subclasses implement validateProps(...) and explicitly validate after construction.
• AggregateRoot event recording is protected; callers use aggregate behavior rather than addEvent(...).
• Domain events require an explicit ID, event name, schema version, occurrence timestamp, and payload.
• node:crypto is removed from the DDD event base class.

Changeset

• @rineex/ddd: major release

Validation

• @rineex/ddd: typecheck, 183 tests, lint, and build pass.
• Authentication core tests: 47 passing.
• Passwordless tests: 160 passing.
• Pre-push test suite completed successfully.

Known pre-existing issues

Authentication typecheck still reports unrelated missing OAuth repository symbols, a missing passwordless repository module, and existing MFA registry/test-fixture errors.

[changeset-bot]

🦋 Changeset detected

Latest commit: c3f98e9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@rineex/ddd	Major
@rineex/auth-core	Patch
@rineex/authentication-method-otp	Patch
@rineex/authentication-method-passwordless	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.