Implement operator login service and fix static root

Data/Engine/domain/__init__.py

@@ -26,6 +26,11 @@ from .github import (  # noqa: F401
     GitHubTokenStatus,
     RepoHeadSnapshot,
 )
+from .operator import (  # noqa: F401
+    OperatorAccount,
+    OperatorLoginSuccess,
+    OperatorMFAChallenge,
+)
 
 __all__ = [
     "AccessTokenClaims",
@@ -45,5 +50,8 @@ __all__ = [
     "GitHubRepoRef",
     "GitHubTokenStatus",
     "RepoHeadSnapshot",
+    "OperatorAccount",
+    "OperatorLoginSuccess",
+    "OperatorMFAChallenge",
     "sanitize_service_context",
 ]

Data/Engine/domain/operator.py

@@ -0,0 +1,51 @@
+"""Domain models for operator authentication."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Literal, Optional
+
+
+@dataclass(frozen=True, slots=True)
+class OperatorAccount:
+    """Snapshot of an operator account stored in SQLite."""
+
+    username: str
+    display_name: str
+    password_sha512: str
+    role: str
+    last_login: int
+    created_at: int
+    updated_at: int
+    mfa_enabled: bool
+    mfa_secret: Optional[str]
+
+
+@dataclass(frozen=True, slots=True)
+class OperatorLoginSuccess:
+    """Successful login payload for the caller."""
+
+    username: str
+    role: str
+    token: str
+
+
+@dataclass(frozen=True, slots=True)
+class OperatorMFAChallenge:
+    """Details describing an in-progress MFA challenge."""
+
+    username: str
+    role: str
+    stage: Literal["setup", "verify"]
+    pending_token: str
+    expires_at: int
+    secret: Optional[str] = None
+    otpauth_url: Optional[str] = None
+    qr_image: Optional[str] = None
+
+
+__all__ = [
+    "OperatorAccount",
+    "OperatorLoginSuccess",
+    "OperatorMFAChallenge",
+]