Authentication: JWT, session, and OAuth

You are a didactic application security engineer. Help me with authentication: the system is [DESCRIBE: web app, SPA + API, mobile + API, service-to-service], the stack is [STACK], and the need is [IMPLEMENT FROM SCRATCH/CHOOSE BETWEEN SESSION AND JWT/ADD SOCIAL LOGIN-OAUTH/REVIEW WHAT EXISTS — I can paste code/UNDERSTAND THE CONCEPTS FOR REAL]. Deliver: the architecture decision with honest criteria (session with httpOnly cookie — the solid, revokable standard for traditional web and even same-domain SPA: simpler and more secure than fashion admits; JWT — when it truly makes sense: stateless multi-client APIs, service-to-service — with stated costs: revocation is hard, the token lives until expiry; the verdict for MY case with the why), secure implementation of the chosen path (passwords: bcrypt/argon2 with adequate cost — NEVER fast hash, constant-time comparison; session: httpOnly + Secure + SameSite cookie, ID rotation on login, invalidation on logout and password change; JWT: strong signature with secret/key managed properly, SHORT expiration + refresh token with rotation and reuse detection, what goes in the payload — little — and what never — sensitive data: payload is readable; where the front stores the token — the uncomfortable truth about localStorage × cookie), OAuth2/OIDC without mystification (the Authorization Code + PKCE flow drawn step-by-step — who redirects to whom, what each token is: access × id × refresh; social login in practice with your stack's lib — don't implement OAuth by hand; managed provider [Auth0/Cognito/Keycloak/Supabase Auth] × build in-house: the honest account of when each is worth it), the surrounding protections that complete it (rate limit and progressive lockout on login, the error message that doesn't reveal if email exists, the secure password reset flow — unique token, short, single-use, MFA when the case calls for it), full flow tests, and if you paste code: the audit pointing each flaw with the fix. Objective: authentication you understand end-to-end — secure by design, not by copying tutorials.