docs: add plugin-auth to documentation (packages, services, kernel-services)

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

content/docs/concepts/core/services.mdx

@@ -76,6 +76,7 @@ The core ecosystem defines several standard service contracts:
 | :--- | :--- | :--- |
 | `http-server` | `IHttpServer` | `plugin-hono-server`, `adapter-nextjs` |
 | `database` | `IDatabaseDriver` | `driver-postgres`, `driver-sqlite`, `driver-mongo` |
+| `auth` | `IAuthService` | `plugin-auth` |
 | `protocol` | `IProtocolEngine` | `@objectstack/objectql` |
 | `api-registry` | `IApiRegistry` | `@objectstack/core` |
 | `cache` | `ICacheProvider` | Redis, Memcached, or in-memory |

content/docs/concepts/packages.mdx

@@ -5,7 +5,7 @@ description: Complete reference of all ObjectStack packages in the monorepo
 
 # Package Reference
 
-ObjectStack is distributed as a monorepo containing **15 packages** organized into core packages, adapters, and plugins.
+ObjectStack is distributed as a monorepo containing **16 packages** organized into core packages, adapters, and plugins.
 
 > **Note for AI Agents**: Each package's `README.md` contains a specific "AI Development Context" section describing its architectural role and usage rules.
 
@@ -15,9 +15,9 @@ ObjectStack is distributed as a monorepo containing **15 packages** organized in
 | :--- | :---: | :--- |
 | [Core Packages](#core-packages) | 9 | Essential runtime, protocols, client SDKs, and CLI |
 | [Adapter Packages](#adapter-packages) | 3 | Framework adapters (Hono, NestJS, Next.js) |
-| [Plugin Packages](#plugin-packages) | 3 | Drivers and server plugins |
+| [Plugin Packages](#plugin-packages) | 4 | Drivers, server, and authentication plugins |
 
-**Total: 15 packages**
+**Total: 16 packages**
 
 ---
 
@@ -424,6 +424,41 @@ Framework adapters that bridge ObjectStack's unified `HttpDispatcher` to specifi
 
 ---
 
+### @objectstack/plugin-auth
+
+**Description:** Authentication & Identity Plugin for ObjectStack
+
+**Purpose:** Provides authentication and identity management services for ObjectStack applications with plugin structure ready for better-auth integration.
+
+**Key Features:**
+- **Plugin Lifecycle**: Full init/start/destroy lifecycle implementation
+- **Service Registration**: Registers `auth` service in ObjectKernel
+- **HTTP Route Scaffolding**: `/api/v1/auth/*` endpoints via IHttpServer
+- **Configuration Support**: Uses `AuthConfig` schema from `@objectstack/spec/system`
+- **OAuth Provider Support**: Configuration for Google, GitHub, Microsoft, etc.
+- **Advanced Features**: Organization/team support, 2FA, passkeys, magic links (planned)
+- **Session Management**: Configurable session expiry and refresh (planned)
+
+**API Routes:**
+- `POST /api/v1/auth/login` - User login
+- `POST /api/v1/auth/register` - User registration
+- `POST /api/v1/auth/logout` - User logout
+- `GET /api/v1/auth/session` - Get current session
+
+**Use Cases:**
+- Adding authentication to ObjectStack applications
+- Multi-tenant applications with organization support
+- OAuth social login integration
+- Secure session management
+
+**Status:** 🟡 **IN DEVELOPMENT** - Structure complete, authentication logic planned
+
+**Implementation Status:** ⚠️ **PARTIALLY IMPLEMENTED** - Plugin structure and routes scaffolded, authentication logic to be added with better-auth integration
+
+**Learn more:** [Auth Config Reference](/docs/references/system/auth-config)
+
+---
+
 ## Package Dependencies
 
 ### Dependency Graph

content/docs/guides/kernel-services.mdx

@@ -14,7 +14,8 @@ The ObjectStack protocol defines **17 kernel services** registered via the `Core
 
 - ✅ Implemented — 18 protocol methods (kernel-provided)
 - ⚠️ Framework — metadata (in-memory registry, DB persistence pending)
-- ❌ Plugin Required — 39 protocol methods (to be delivered by plugins)
+- 🟡 In Development — auth (plugin structure complete, logic planned)
+- ❌ Plugin Required — 38 protocol methods (to be delivered by plugins)
 </Callout>
 
 ---
@@ -50,7 +51,7 @@ The ObjectStack protocol defines **17 kernel services** registered via the `Core
 | 1 | **metadata** | `required` | 7 | ⚠️ Framework | Kernel (in-memory) |
 | 2 | **data** | `required` | 9 | ✅ Implemented | `@objectstack/objectql` |
 | 3 | **analytics** | `optional` | 2 | ✅ Implemented | `@objectstack/objectql` |
-| 4 | **auth** | `required` | — | ❌ Plugin Required | TBD plugin |
+| 4 | **auth** | `required` | — | 🟡 In Development | `@objectstack/plugin-auth` |
 | 5 | **ui** | `optional` | 5 | ❌ Plugin Required | TBD plugin |
 | 6 | **workflow** | `optional` | 5 | ❌ Plugin Required | TBD plugin |
 | 7 | **automation** | `optional` | 1 | ❌ Plugin Required | TBD plugin |