Follow-up fixes from an adversarial review of the merged v0.5.0. Each was verified against the code and has a regression test.

Fixed

• Lost RecordSession at login now fails the login. Sessions are recorded before the cookie is issued, so a transient store-write failure no longer mints a session the fail-closed revocation check rejects on the next request ("logged in, then instantly logged out"). Fixed at all four mint sites.
• adminSetBan writes an audit record (ban / unban), matching the other admin verbs.
• Passwordless (social/OIDC-only) users can delete-account / change-email. Step-up is now required only when the user has a re-authable factor (password/TOTP) — those users have neither, so the gate was a permanent lockout.

Security

• Sec-Fetch-Site: cross-site is refused on the CSRF-token-exempt login entry points (e.g. /auth/email-otp/verify), closing a cross-site login-CSRF even with no TrustedOrigins/AppURL allow-list configured. Strictly additive (Fetch Metadata).

Changed

• The in-memory SessionStore prunes expired rows and is documented demo / single-process only — an unknown SID fails closed, so a restart (empty map) logs everyone out; use gormstore for anything that restarts.

⚠️ Migration (from v0.5.0)

• A social-login-only deployment now enforces the gate + CSRF (enforcing() counts social providers). Apps that made state-changing POST /api/... calls without the double-submit token must now send the X-CSRF-Token header.

Full details: CHANGELOG.md