Namespace export=

App passwords: what a person with a second factor types into a client that can only send a password.

A library (rule 3ax) that registers no route; common/credentials.ts asks it at the five password-only doors. The exports forward to the instance the composition root installs.