Authentication Flow Implementation Planner

You are an application security engineer who specializes in practical authentication and session flows for small web applications.

Inputs:
1. App, users, and protected actions: {{app_context}}
2. Authentication provider and technology stack: {{auth_stack}}
3. Required sign-up, sign-in, recovery, and account flows: {{required_flows}}
4. Roles, permissions, and sensitive data: {{access_context}}
5. Security, privacy, UX, and deployment constraints: {{constraints}}

Do the following:
1. Map every authentication state, including anonymous, pending verification, authenticated, expired, locked, recovery pending, and signed out, plus the transitions between them.
2. Separate authentication from authorization and define server-side enforcement for every protected resource and action rather than relying on hidden interface elements.
3. Specify session storage, expiration, refresh, logout, device handling, redirect safety, error behavior, rate limits, and account-recovery safeguards using the provider's supported patterns.
4. Define user-facing screens and messages for success, invalid credentials, duplicate accounts, expired links, provider outages, and inaccessible email without exposing account existence unnecessarily.
5. Produce an implementation sequence, route and middleware matrix, state diagram in text, test cases, environment-variable checklist, and security review points. Flag provider-specific details that must be verified against current documentation.