docs: record auth session store wiring

REFACTORING-AUDIT.md

@@ -298,6 +298,7 @@ The current composition root is `cmd/serve.go`; `repository.System` aggregates P
 - Added access/refresh JWT verifier contracts and an infrastructure adapter delegating to the existing parser; full Auth tests pass in `ad6f5cc`. Runtime injection into all auth flows remains.
 - Injected the verifier into IAM and refresh-token flows through runtime composition, retaining fallback for compatibility; full Auth tests pass in `6c5b8cc`.
 - Extracted active/expiry session policy into `application/auth` with focused tests; integration into IAM/session retrieval remains for the next checkpoint (`424741c`).
+- Added a domain-session `SessionStore` contract, infrastructure adapter over the legacy cache/persistence composition, and runtime wiring for IAM retrieval; full Auth tests pass in `d744ffc`. The adapter deliberately preserves existing Redis-expiry semantics without activating stricter status checks during the refactor.
 - A005 remains in progress: JWT validation, session checks, refresh-token flow, and broader authentication orchestration still need application ports and adapters.
 
 ### `I001` — publisher-backed ICO purchase map

REFACTORING-TODO.md

@@ -108,7 +108,7 @@ This is the authoritative execution tracker for the refactor. Work is performed
 | A002 | `DONE` | Introduce auth domain entities, value objects, errors, and repository ports. | Added pure Auth entities/value objects, domain errors, and inward-facing repository/cache ports with no gRPC, GORM, Redis, or framework imports; committed as `32f182b`/`d292822`. |
 | A003 | `STARTED` | Move auth persistence and Redis implementations into infrastructure. | Explicit mappings and domain-port adapters now cover users, identities, sessions, permissions, roles, role-permissions, bank information, OTP templates, and cache; legacy repository integration and ownership migration remain. |
 | A004 | `DONE` | Extract OTP application use cases and thin gRPC adapters. | OTP primitives, persistence/provider adapters, runtime/template wiring, and thin gRPC registration adapters are in place; full Auth tests pass. |
-| A005 | `STARTED` | Extract authentication/JWT application use cases and adapters. | Access-token normalization is now an application primitive; JWT validation, session checks, refresh flow, and adapter extraction remain. |
+| A005 | `STARTED` | Extract authentication/JWT application use cases and adapters. | Token normalization/policy, JWT verification, and session retrieval boundaries are extracted and runtime-wired; refresh-session persistence and final orchestration remain. |
 | A006 | `TODO` | Extract identity and permission use cases and adapters. | Public and internal authorization services pass tests. |
 | A007 | `TODO` | Replace auth bootstrap with explicit dependency composition. | Dependency direction is enforced and the service builds. |
 | A008 | `TODO` | Remove superseded auth packages and compatibility shims. | No dead imports or duplicate implementations remain. |
@@ -302,3 +302,4 @@ Append one row whenever a task changes status. Existing rows are never rewritten
 | 2026-08-30 | A005 | `STARTED` | `STARTED` | Added application JWT verifier contract and infrastructure adapter for access/refresh claims; full Auth tests pass in `ad6f5cc`. |
 | 2026-08-30 | A005 | `STARTED` | `STARTED` | Injected the JWT verifier into IAM and refresh-token flows with compatibility fallback; full Auth tests pass in `6c5b8cc`. |
 | 2026-08-30 | A005 | `STARTED` | `STARTED` | Extracted active/expiry session policy into `application/auth`; focused and full Auth tests pass in `424741c`. |
+| 2026-08-30 | A005 | `STARTED` | `STARTED` | Added and runtime-wired the authentication session-store boundary for IAM retrieval while preserving Redis-expiry behavior; full Auth tests pass in `d744ffc`. |