Act as a senior security engineer. Harden the existing sign-in in my {{tech_stack}} app. Roles: {{user_roles}}. Keep the current auth provider and flows, and change only what this needs. Before changing anything, read the auth code and provider settings and tell me what's in place. Sessions: - Cookies set HttpOnly, Secure and SameSite Lax; no tokens in localStorage if the provider supports cookies - A new session on sign-in and on any role change - An idle timeout and an absolute lifetime, shorter for admins - Changing a password signs out other sessions, plus a Sign out of all devices button Passwords: - At least 12 characters, 64 or more allowed, any characters, no forced symbols or scheduled resets - New passwords checked against a breached-password list with a k-anonymity range lookup - If we hash passwords ourselves, argon2id or bcrypt; otherwise confirm the provider does - Paste and password managers allowed, with the right autocomplete values Two-step sign-in: - Authenticator app codes and passkeys; SMS only as a fallback - Required for admins, offered to everyone - Recovery codes shown once and stored hashed Account enumeration: - The same message and similar response time for failed sign-in, sign-up with an existing email, and password reset, such as "If that account exists, we've sent an email" - Reset links single-use, stored hashed, expiring in 30 minutes Also: ask for the password again before changing email, password or 2FA, or deleting the account; email people when those change or after a sign-in from a new device; rate limit all of it. Never weaken a check to fix a sign-in bug. Finish with a table: risk, what we had, what changed. Then how to test each item, and anything the provider can't do.