Why: provide service-side canonical login/refresh orchestration for session-based web auth.
What: add session contracts, refresh token codec with provider-agnostic secret boundary, grpc session methods, DI wiring, tests, and docs.
Rule: preserve thalos identity ownership and keep transport adapters at service edge.
Why: align service runtime packaging and health endpoints for container execution.
What: add Docker build assets, container runbook, and dual health mappings with explicit http/grpc ports.
Rule: keep technical intent only and avoid orchestration references.
