Task-by-task TDD plan covering config, the new internal/auth package (session cookies, Keycloak OIDC verifier, RequireSession middleware), wiring into internal/api and cmd/geniusrund, and the frontend LoginGate. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>