v1.33.0 — Slim Skeleton & First-Party Identity

A leaner Glueful starter: the skeleton no longer ships core database schema, adopts
the first-party glueful/users identity store, and adds a switchboard for core
platform-capability schema. RBAC remains opt-in.

Added

• glueful/users ^1.0.0 (Packagist) — identity store + account lifecycle (email
  verification, password recovery), email-PIN 2FA, and read endpoints GET /me,
  GET /users/{uuid}, and the paginated GET /users.
• USERS_* env flags (default false): USERS_USER_LOOKUP_ENABLED,
  USERS_USER_LIST_ENABLED, USERS_USER_LIST_ALLOW_EMAIL_FILTER.
• Opt-in RBAC docs — enable glueful/aegis, then
  php glueful aegis:bootstrap-admin --user=<uuid-or-email> to grant users.read.
• config/capabilities.php — Core Capability Schema Switchboard
  (scheduler/notifications/metrics/archive).
• Identity-seam tests + project phpunit.xml.

Changed

• User store extracted to glueful/users; users/profiles/2FA now owned by the
  extension. It resolves from Packagist (^1.0.0) — the ../extensions/users
  path repo was removed.

Removed

• All bundled core migrations (001–010). Schema is now owned by the package
  that uses it: identity (users/profiles/2FA) → glueful/users; auth spine
  (auth_sessions/auth_refresh_tokens/api_keys), queue, notifications, archive,
  locks, scheduler → framework core. database/migrations/ is empty for your
  application migrations.

Upgrade Notes

• Starter template — affects newly-scaffolded projects, not a live update.
• Fresh installs: php glueful migrate:run applies framework + extension
  migrations only; don't re-add the removed skeleton migrations.
• /users endpoints are off by default and require an RBAC provider — see the
  README "Identity, Accounts & RBAC" section.

Full changelog: CHANGELOG.md · compare: v1.32.0...v1.33.0