feat(auth): require verified new-browser trust with fixed expiry

packages/auth/README.md

@@ -1,5 +1,19 @@
 # @wrnexus/auth
 
+### New-browser verification and device trust
+
+Enable `requireTrustedDeviceVerification: true` to require a verified email or
+SMS challenge before an untrusted browser receives a sign-in session. The HTTP
+handlers use a host-only HttpOnly random cookie, ignoring posted fingerprints.
+Direct engine callers must supply a trusted server-side browser fingerprint.
+`trustSignupDevice: true` grants the registration browser one-time trust after
+required account verification, at its first successful sign-in.
+
+Use `trustedDeviceTtlMs: 30 * 86400_000` for 30-day trust. Ordinary logins do not
+renew it. The verification form offers explicit trust consent; expiry/revocation
+requires a new email/SMS challenge. Successful login alerts use both verified
+contact channels when configured. Delivery still requires an application adapter.
+
 ### Signup business logic and verification-only sessions
 
 ```ts