add el-identity: Engram-native identity, OAuth, @authenticate by default

crates/el-aop/src/lib.rs

@@ -4,12 +4,20 @@
 //! import. Built into the framework. Applied as decorators:
 //!
 //! ```text
-//! @authenticate
+//! @authenticate          ← applied by DEFAULT to every function
 //! @authorize(role: "admin")
 //! @cache(ttl: 300)
 //! @rate_limit(requests: 100, per: 60)
 //! component AdminDashboard { ... }
+//!
+//! @public                ← explicit opt-out of authentication
+//! component LandingPage { ... }
 //! ```
+//!
+//! ## Security-by-default
+//!
+//! `@authenticate` is the default. Functions without `@public` are protected.
+//! This makes it as hard as possible to accidentally ship an unprotected endpoint.
 
 pub mod aspects;
 pub mod chain;
@@ -20,8 +28,11 @@ pub use aspects::{
     TraceAspect, ValidateAspect,
 };
 pub use chain::AspectChain;
+pub use public::PublicMarker;
 pub use registry::AspectRegistry;
 
+pub mod public;
+
 #[cfg(test)]
 mod tests;