Initial baseline: LaraBlog core with plugin commerce surface.

Captures the current working tree after theme slots, ArticleAccess, and the payment / paid-content plugins so subsequent work has a reviewable git history.

app/Auth/LaraBlogUserProvider.php

@@ -0,0 +1,71 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Auth;
+
+use App\Models\User;
+use Illuminate\Auth\EloquentUserProvider;
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Support\Facades\Hash;
+
+class LaraBlogUserProvider extends EloquentUserProvider
+{
+    public function retrieveByCredentials(array $credentials): ?Authenticatable
+    {
+        if ($credentials === []) {
+            return null;
+        }
+
+        $query = $this->newModelQuery();
+
+        foreach ($credentials as $key => $value) {
+            if (in_array($key, ['password', 'token'], true)) {
+                continue;
+            }
+
+            if ($key === 'login') {
+                $query->where(function ($builder) use ($value): void {
+                    $builder->where('email', $value)
+                        ->orWhere('username', $value);
+                });
+
+                continue;
+            }
+
+            $query->where($key, $value);
+        }
+
+        return $query->first();
+    }
+
+    public function validateCredentials(Authenticatable $user, array $credentials): bool
+    {
+        $plain = (string) ($credentials['password'] ?? '');
+
+        if ($plain === '') {
+            return false;
+        }
+
+        if ($this->hasValidBcryptPassword($user, $plain)) {
+            return true;
+        }
+
+        if ($user instanceof User) {
+            return $user->attemptLegacyPasswordUpgrade($plain);
+        }
+
+        return false;
+    }
+
+    protected function hasValidBcryptPassword(Authenticatable $user, string $plain): bool
+    {
+        $hashed = $user->getAuthPassword();
+
+        if (! is_string($hashed) || $hashed === '') {
+            return false;
+        }
+
+        return Hash::check($plain, $hashed);
+    }
+}