refactor(startup): isolate security composition

docs/architecture-overview.md

@@ -285,7 +285,9 @@ sequenceDiagram
   `HostRuntime.settings` 的窄服务读写可变部署设置，业务域不接触 Settings 实例；生产与测试组合根统一
   复用 `startup/composition/configuration.py` 的映射、快照加载与发布。`startup/composition/database.py`
   持有数据库 worker、兼容事务 runner、查询/插件持久化和旧 `ApiDataPorts` 的具体装配；initializer
-  只保留顺序调用。`ApiDataPorts` 仅保留旧导入 ABI，不参与正式请求链路。
+  只保留顺序调用。`startup/composition/security.py` 统一装配认证、用户查询、PassKey 与 Web 访问
+  provider，并将同一 `AuthenticationRuntime` 交给 HostRuntime。`ApiDataPorts` 仅保留旧导入 ABI，
+  不参与正式请求链路。
 - **安全模式**：`MOVIEPILOT_SAFE_MODE` 会跳过插件、定时器、监控器、命令与工作流，用于故障自救。
 - **Scheduler 同名职责包**：旧 `app/scheduler.py` 单体已退役；`catalog.py` 负责作业目录和计划投影，
   `execution.py`、`bridge.py`、`progress.py` 分别负责执行、跨循环句柄和进度终态，`registry.py`

docs/architecture-refactor-roadmap.md

@@ -342,6 +342,8 @@ TMDB、豆瓣、Bangumi、AniList 详情到统一字段的规则一次迁入 `ap
 - `startup/composition/database.py` 唯一持有 `DatabaseWorker`、兼容事务 runner、查询服务、
   插件持久化、工作流查询和旧 `ApiDataPorts` 的具体数据库装配；runtime 拒绝重入，Worker 成功后
   才发布事务入口，关闭失败时保留 owner 与 provider，成功关闭后对称撤销。
+- `startup/composition/security.py` 唯一构造并登记认证、用户查询、PassKey 与 Web 认证入口，
+  initializer 只消费其返回的 `AuthenticationRuntime`，不再保留第二份安全服务装配。
 - `startup/initializers/modules.py` 只按原顺序调用 composition API，并继续构造尚未迁移的领域运行时；
   本批未改变 HostRuntime、插件 ABI、SDK/Compat 或生命周期 manifest，`app/plugins/**` 未改动。
 - 模块 owner 完整收敛后撤销 `app.state.host_runtime`；启动失败直接关闭 Worker、撤销本批 provider 并

docs/rules/05-architecture.md

@@ -140,7 +140,10 @@ not startup. Lower-level runtime modules must not import startup.
 runtime/settings construction and publication. `startup/composition/database.py`
 owns the process database worker, compatibility transaction runner, query services,
 plugin persistence and legacy API data-port wiring. Initializers call these owners in
-startup order and must not recreate their concrete construction. Database runtime
+startup order and must not recreate their concrete construction.
+`startup/composition/security.py` owns authentication, user lookup, PassKey and Web
+access provider assembly; `initializers/modules.py` only invokes that owner and places
+its returned `AuthenticationRuntime` into the host runtime. Database runtime
 ownership rejects overlapping lifespans; after a successful worker shutdown, the
 configuration/database composition owners must revoke every provider they published
 before releasing database connections. Other domain providers remain owned by their