Hardened auth includes bcrypt credentials, refresh rotation, SIWE-style wallet login, and Redis-backed challenge nonces.