TIN-1605: Add Tinyland databaseless auth MVP

[Jess Sullivan (Jesssullivan)]

Summary

• relax handle-first auth types so AdminUser, TOTP labels, and invitations can omit email instead of fabricating handle@localhost
• add an executable Tinyland databaseless auth MVP covering handle-only users, TOTP, backup codes, sessions, invites, provider-bound GitHub handoff, and fingerprint/Tempo-as-evidence boundaries
• document the package/app boundary for tinyland.dev adoption and wire the example into the Bazel test target data

Validation

• pnpm exec tsc --noEmit
• pnpm test (16 files, 360 tests)
• pnpm build
• pnpm check:package
• bazel test //:test
• git diff --check

Linear

TIN-1605