State Machine

Auth state transitions: idle → authenticating → success / error.