🔒 Hardware & TOTP Enforcement: Session token minting requires verified authenticator assertions.

⏱️ Ephemeral Session: Access tokens expire in 900 seconds (15 minutes). No credentials stored on disk.