domain ports: CQRS-split traits for all bounded contexts

crates/domain/src/ports/auth.rs

@@ -0,0 +1,19 @@
+//! Authentication port.
+//!
+//! Abstracts password hashing and verification so the domain layer
+//! never depends on a specific hashing algorithm (bcrypt, argon2, etc.).
+
+use crate::errors::DomainResult;
+
+/// Port for password hashing and verification.
+///
+/// Implementations live in the infra layer (e.g. `BcryptAuthService`).
+/// These methods are intentionally synchronous — hashing libraries are CPU-bound
+/// and should be spawned on a blocking thread pool by the caller if needed.
+pub trait AuthService: Send + Sync {
+    /// Hash a plaintext password and return the encoded hash string.
+    fn hash_password(&self, password: &str) -> DomainResult<String>;
+
+    /// Verify a plaintext password against an encoded hash.
+    fn verify_password(&self, password: &str, hash: &str) -> DomainResult<bool>;
+}