Add migration to add auth_user_id column to users table

- Introduced a new column 'auth_user_id' of type UUID to the 'users' table.
- Updated existing user data to set 'auth_user_id' to null for UserId 1.
- Created a unique index on 'auth_user_id' to enforce uniqueness.
- Implemented rollback functionality to remove the column and index if needed.

docs/11-BACKEND-PHASE1.md

@@ -18,10 +18,9 @@ Path-based versioning. Breaking changes bump the major version.
 ```
 Authorization: Bearer <access_token>
 ```
-- Every endpoint requires a valid **Bearer JWT**; unauthenticated → `401`.
-- **RBAC is NOT enforced in Phase 1** (FR-X-01): any authenticated user may call any endpoint.
-- The token subject (`sub`) is the **audit actor** on every mutation. Clients never send `createdBy`; the server derives it.
-- Tokens are issued by a simple in-app login (`/auth/login`, §2.0).
+- Every endpoint requires a valid **Bearer JWT**; unauthenticated → `401`. Tokens are issued by the **external AuthHex IdP** (not ERPCore) — **RS256**, issuer `AuthHex`, audience `AuthHexClient`. ERPCore validates them against AuthHex's static RSA public key (no JWKS) and admits only holders of the configured ERP `UserType`/`Role` (door policy) → otherwise `403`.
+- **Per-endpoint RBAC is NOT enforced in Phase 1** (FR-X-01): any ERP-admitted user may call any endpoint.
+- The **audit actor** is AuthHex's custom **`UserId` (GUID)** claim, mapped to a local shadow user (`long`). Clients never send `createdBy`; the server derives it (docs/10 A.4).
 
 ### 1.3 Content type & encoding
 `application/json`, UTF-8, **camelCase**. Timestamps ISO 8601 UTC (`2026-07-07T09:30:00Z`); dates `YYYY-MM-DD`. Base currency **LKR** in Phase 1.
@@ -60,16 +59,15 @@ Domain errors add a stable `code` (catalog §7):
 
 ## 2. Master Data
 
-### 2.0 Auth
-#### `POST /auth/login`
+### 2.0 Auth — **external (AuthHex IdP); not an ERPCore endpoint**
+> **Superseded (2026-07-14).** ERPCore no longer exposes `/auth/login`. Login, registration and recovery are owned by the
+> separate **AuthHex** service (e.g. `POST /api/loginUser` with `{ identifier, password }`), which returns an **RS256** JWT
+> (issuer `AuthHex`, audience `AuthHexClient`; claims `UserId` (GUID), `UserTypeCode`, `RoleCode`, `NIC`, …). ERPCore only
+> **validates** that Bearer token and provisions a local shadow user (docs/10 A.4). The old shape is retained here for history:
 ```json
-{ "username": "storekeeper01", "password": "••••••••" }
+POST {AuthHex}/api/loginUser   →   { "identifier": "…", "password": "••••••••" }
+// 200 → an RS256 access token (Bearer). Bad credentials → 401. Token → ERPCore Authorization: Bearer <token>.
 ```
-**200 OK**
-```json
-{ "accessToken": "eyJhbGciOi...", "tokenType": "Bearer", "expiresInMinutes": 120, "userId": 17, "displayName": "Nimal Perera" }
-```
-`401` on bad credentials.
 
 ### 2.1 Items
 #### `GET /items`