Add a new auth package implementing password hashing/verification (PBKDF2-HMAC-SHA256), a random-string generator, and unit tests. Update .gitignore to catch additional sensitive filenames and to ignore legacy dev scripts, migrations, templates and build artifacts. Remove many legacy/dev helper scripts (dev_modules/, scripts/legacy/, build_windows.sh, migrations/, templates/) and add web-nodejs reset-password scripts and a session secret placeholder. Changes consolidate authentication utilities and clean up old/unused development tooling and noise in the repo.