Allauth extracted to its own repository (~/dev/mizan-allauth)

The auth-provider concern becomes a dedicated Django system. Removed from
mizan: the Django integration (mizan/integrations/allauth — auth contexts
+ ~15 form wrappers), the legacy/ pre-kernel TypeScript client, the
allauth and webauthn dependency extras (fido2 was consumed only by the
WebAuthn form wrappers), and the HEADLESS_JWT_* settings fallbacks — the
allauth-headless compat seam belongs to the dedicated system, not to
mizan's JWT module. Duplicate-name registration in discovery now surfaces
a warning instead of passing silently. README claims updated to point at
mizan-allauth; the root README's hand-maintained status matrix collapsed
into the tests/afi conformance suite as the parity authority.
OWED_SURFACE.md refreshed against the post-extraction tree (22 units).

mizan-django suite: 350 passed, 21 skipped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontends/mizan-react/README.md

@@ -95,7 +95,6 @@ directory (Stage 1 is auto-included whenever `react` is a target):
 | `@rythazhur/mizan/channels` | WebSocket channels |
 | `@rythazhur/mizan/jwt` | JWT token management |
 | `@rythazhur/mizan/client` | HTTP clients (CSR/SSR) |
-| `@rythazhur/mizan/allauth` | Allauth UI components |
 
 These are **library internals** used by the generated code. You should import from `@/api` (your generated index), not from the library directly.
 

frontends/mizan-react/src/jwt/index.ts

@@ -1,79 +1,2 @@
-/**
- * mizan/jwt
- *
- * JWT token management via mizan server functions.
- * Handles token lifecycle: obtain, refresh, clear.
- *
- * ## Quick Start
- *
- * Use JWTContext in authenticated areas (e.g., inside UserRoute):
- *
- * ```tsx
- * import { JWTContext } from 'mizan/jwt'
- * import { UserRoute } from 'mizan/allauth'
- *
- * function ProtectedPage() {
- *     return (
- *         <UserRoute>
- *             <JWTContext>
- *                 <MyProtectedContent />
- *             </JWTContext>
- *         </UserRoute>
- *     )
- * }
- * ```
- *
- * Then use JWT-authenticated requests:
- *
- * ```tsx
- * import { useDjangoCSRClient, Auth } from 'mizan/client/react'
- *
- * function MyProtectedContent() {
- *     const client = useDjangoCSRClient(Auth.JWT)
- *
- *     const fetchData = async () => {
- *         const response = await client.request('GET', '/api/protected/')
- *         return response.json()
- *     }
- * }
- * ```
- *
- * ## How It Works
- *
- * 1. JWTContext calls jwt_obtain server function (via /api/mizan/call/)
- * 2. If not authenticated, returns FORBIDDEN (tokens stay null)
- * 3. Client uses getAccessToken() for Bearer token injection
- * 4. Tokens auto-refresh via jwt_refresh server function
- * 5. On logout, call clearTokens()
- *
- * ## Configuration
- *
- * ```tsx
- * <JWTContext
- *     config={{
- *         endpoint: '/api/mizan/call/',  // default
- *         refreshBuffer: 30,               // refresh 30s before expiry
- *         autoObtain: true,                // obtain on mount
- *         autoRefresh: true,               // auto-refresh before expiry
- *     }}
- * >
- * ```
- *
- * ## Manual Token Management
- *
- * ```tsx
- * import { useJWT } from 'mizan/jwt'
- *
- * function LogoutButton() {
- *     const jwt = useJWT()
- *
- *     const handleLogout = async () => {
- *         await fetch('/api/logout/', { method: 'POST' })
- *         jwt?.clearTokens()
- *     }
- * }
- * ```
- */
-
 export { JWTContext, useJWT, useJWTRequired, useJWTReady } from './JWTContext'
 export type { JWTTokens, JWTConfig, JWTState } from '../client/types'