Please perform a final refactoring on PR #46 to consolidate the Authentication Architecture and resolve conflicts with the existing identity.zod.ts. #48

The goal is to strictly separate "Authentication" (Providers/Strategies) from "Identity" (User Models).

Task 1: Migrate Authentication Providers (Resolve Conflicts)

Migrate the legacy Enterprise Auth definitions from packages/spec/src/system/identity.zod.ts into the new packages/spec/src/system/auth.zod.ts.

• Move OIDCConfigSchema to auth.zod.ts.
• Move SAMLConfigSchema to auth.zod.ts.
• Move LDAPConfigSchema to auth.zod.ts.
• Add a new optional field enterprise to the main AuthConfig schema in auth.zod.ts to hold these configurations (e.g., enterprise: z.object({ saml: ..., ldap: ... }).optional()).

Task 2: Redefine Identity as User Model

Refactor packages/spec/src/system/identity.zod.ts to become the dedicated User Model Specification.

• Remove AuthProviderSchema and all auth-related configs from this file (since they are now in auth.zod.ts).
• Create and export UserSchema:
  • Fields: id (string), email (email), emailVerified (boolean), name (optional string), image (optional url), createdAt (date), updatedAt (date).
• Create and export AccountSchema (for linking OAuth accounts).
• Create and export SessionSchema.

Task 3: Define Wire Protocol & Constants

Create packages/spec/src/system/auth-protocol.ts (new file) to define the API contract:

• Export AUTH_CONSTANTS:
  • HEADER_KEY: 'Authorization'
  • TOKEN_PREFIX: 'Bearer '
  • COOKIE_PREFIX: 'os_'
  • CSRF_HEADER: 'x-os-csrf-token'
• Export AuthHeaders interface.

Task 4: Cleanup & Consistency

• Ensure packages/spec/src/index.ts exports the new schemas from both auth.zod.ts (Configuration) and identity.zod.ts (Data Models).
• Update docs/AUTHENTICATION_STANDARD.md to reflect that Enterprise Authentication (SAML/LDAP) is now part of this unified standard.

This refactoring will result in:

1. auth.zod.ts: How to login (Config for OAuth, Email, SAML, better-auth driver settings).
2. identity.zod.ts: Who is logged in (Standard User/Session data models).
3. auth-protocol.ts: How to communicate (API constants).