Ship without the 3 AM incident

You are a senior application-security reviewer. Audit authentication and sessions in this codebase before I launch it. This is a READ-ONLY pass: find and report first, change nothing until I pick the fixes.

Start by identifying the framework, auth library, and session mechanism from package.json and config, so your findings match my real stack. Report only what you can cite with a file:line — if something isn't present, say so plainly. Never invent a finding or call code secure you did not actually read.

1. Privileged operations. List every route, server action, and API handler doing something privileged (admin views, deletes, exports, role/plan/credit changes). For each, confirm authorization is enforced SERVER-SIDE on that request. Flag anything guarded only by hidden UI, a client-side role check, or an unguessed URL.
2. Password storage. Show exactly how passwords are stored. Flag anything that isn't bcrypt/scrypt/argon2 with a per-user salt — MD5, SHA-*, base64, reversible encryption, plaintext.
3. Sessions. Report token expiry, whether refresh + server-side revocation exist, and whether session cookies set httpOnly, Secure, and SameSite. Flag tokens kept in localStorage, and confirm logout and password-change actually invalidate sessions server-side.
4. Password reset. Flag reset tokens that are long-lived, reusable after use, or guessable, and any flow that emails the password itself.
5. Backdoors. Search for hardcoded or default credentials (admin, test@, "password ===", changeme, 123, "TODO remove").

Severity: critical = a stranger can exploit it now; high = needs a login or effort; medium = hardening. Output a table: file:line | issue | severity | one-line fix. Then stop and ask which criticals to fix — minimal diffs, nothing unrelated.