Implement Authentication and Authorisation

Implement a complete authentication and authorisation system for the following:

Application type: [web app / API / mobile backend]
Language/framework: [Node.js/Express / Python/FastAPI / PHP/Laravel / other]
Database: [PostgreSQL / MySQL / MongoDB / other]
Auth methods to support: [email+password / Google OAuth / GitHub OAuth / magic link / other]
Session management: [JWT / session cookies / refresh tokens]
Roles needed: [list roles — e.g. admin / moderator / user / guest]
Permissions model: [role-based (RBAC) / attribute-based (ABAC) / simple flag-based]
Special requirements: [2FA / API keys / multi-tenancy / SSO]

Provide a complete implementation:

USER REGISTRATION:
- Registration endpoint with validation
- Password hashing (bcrypt/argon2)
- Email verification flow
- Duplicate detection

LOGIN:
- Login endpoint
- Credential verification
- Token/session generation
- Failed attempt handling and lockout

TOKEN MANAGEMENT:
- Access token generation and validation
- Refresh token rotation
- Token revocation
- Secure storage recommendations

OAUTH FLOW (if applicable):
- OAuth provider setup
- Callback handling
- Account linking (if user exists with same email)

ROLE AND PERMISSION SYSTEM:
- Database schema for roles and permissions
- Middleware for route-level protection
- Helper functions for permission checks
- Admin role management endpoints

PASSWORD MANAGEMENT:
- Forgot password flow
- Reset password with secure token
- Password change (authenticated)
- Password strength requirements

SECURITY HARDENING:
- Rate limiting on auth endpoints
- CSRF protection
- Secure cookie settings
- Security headers

FULL CODE:
- All routes and controllers
- Middleware implementations
- Database migrations/schema
- Helper utilities