- Enterprise SAML/OIDC callbacks used raw 'sso_xxx' string as passwordHash
which would crash bcrypt.compare(). Now uses userRepo.hashPassword(randomUUID())
- Added updateLastLogin() for existing enterprise SSO users
- Upgraded bcrypt cost factor from 10 to 12 per PRD spec
- All 53 auth tests passing
- refresh.sh: idempotent script, auto-discovers repos, updates symlinks + copies docs/workflows
- launchd plist: scheduled daily at 11 PM + on login
- /refresh-chat-history workflow for on-demand Cascade runs
- README updated with auto-refresh docs and full data inventory
- Repo docs and workflows refreshed from all 4 repos