Epic: native integration and adapter coverage #371

Part of #334 (public adoption track).

Goal

Seamless Auth is the product for three jobs:

1. Moving an organization off an expensive or unwanted auth system (the migration track in Epic: public adoption and migration readiness #334)
2. Adding auth to an existing application in any popular language or framework, with very little effort
3. Being the fastest way to scaffold a new product that needs auth

This epic delivers 2 and 3, and makes fells-code/seamless-cli#210 dependable.

Direction

• The auth API stays its own service. One codebase, shipped as a container (managed and Kubernetes), a single binary or npx (self-host), and an embedded handler (Node only).
• The browser model stays Backend-for-Frontend. Tokens stay server-side in the adapter, and the browser holds only an httpOnly cookie on the adopter's own domain.
• The API owns a dedicated Postgres schema and migrates itself. It never writes to the adopter's schema. An SQL export covers teams that route all DDL through their own pipeline.
• Adapters are data-driven: routes declare adapter behaviour in defineRoute, the build emits a manifest, and every adapter follows it. A language-agnostic conformance suite proves each adapter, because the adapter owns the session cookie.

Children

Listed in the order to work them.

Foundation

• feat(routes): declare adapter behaviour in defineRoute and emit an adapter manifest #372 Declare adapter behaviour in defineRoute and emit an adapter manifest
• feat(core): drive the proxy and cookie handling from the API adapter manifest seamless-auth-server#201 Drive the Node adapters from the manifest
• feat(verify): extract a language-agnostic adapter conformance suite seamless-cli#246 Language-agnostic adapter conformance suite

Backend adapters

• feat: Go server adapter (net/http, Gin) #373 Go (net/http, Gin)
• feat: Rust server adapter for Axum #378 Rust (Axum)
• feat: Python server adapter for FastAPI and Django #379 Python (FastAPI, Django)

Frontend bindings

• feat(angular): @seamless-auth/angular bindings seamless-auth-react#170 Angular
• feat(vue): @seamless-auth/vue bindings seamless-auth-react#171 Vue
• feat(svelte): @seamless-auth/svelte bindings seamless-auth-react#172 Svelte

Templates and existing projects

• feat: Angular, Vue and Svelte web templates seamless-templates#111 Angular, Vue and Svelte web templates
• feat: Go, Rust and Python api templates seamless-templates#112 Go, Rust and Python api templates
• feat: add Seamless Auth to an existing app seamless-cli#210 Add Seamless Auth to an existing Express, Fastify or React app
• feat(add): add Seamless Auth to existing Go, Rust, Python, Angular, Vue and Svelte projects seamless-cli#248 Add Seamless Auth to existing Go, Rust, Python, Angular, Vue and Svelte projects

Running it

• feat(db): own a dedicated Postgres schema and ship SQL migrations with migrate and export commands #374 Dedicated Postgres schema, SQL migrations, migrate and export commands
• feat: run without Docker as a single binary or npx, with file config and a PGlite dev mode #375 Single binary or npx, file config, PGlite dev mode
• ci: generate typed API clients from the OpenAPI spec #376 Generated typed API clients
• feat: embedded request handler for Node apps #377 Embedded request handler for Node

Later, not filed: SvelteKit fullstack template.

Done when

• Angular, Vue and Svelte bindings, and Go, Rust (Axum) and Python (FastAPI, Django) adapters, all pass the conformance suite.
• Each has a template, and seamless init combines any web template with any api template into a working app.
• seamless add wires Seamless Auth into an existing project in each of those languages and frameworks, tested end to end from each framework's own starter.
• A new API route needs no change in any adapter.

#374 to #377 improve the experience but do not gate done.