Phase 6: Backend Authentication - Standard stack: Password4j (Argon2id), jwt-scala, java-totp - Architecture: JWT + DB hybrid sessions, progressive lockout, TOTP 2FA - RBAC: WinterCMS-style plugin-registered permissions - Security: OWASP-compliant password storage, session management, reset tokens