nable programmatic creation of built-in User and server-side session start from backend functions (for external auth like Nostr)

Problem: Our app authenticates users via Nostr (NIP-07/NIP-46). We must create a Base44 built-in User and start a Base44 session from a backend function once external auth succeeds.
Currently, backend functions cannot create User (base44.asServiceRole.entities.User.create() → “Entity schema User not found”) nor start sessions (auth.loginAs() / createSession() unavailable). This blocks passwordless / decentralized auth integrations.

What we need (MVP):

1. Service-role API to manage built-in users

   • users.create({ externalId, email?, displayName?, metadata?, roles? })

   • users.getByExternalId(externalId)

   • users.update(userId, { … })

2. Server-side session creation

   • auth.createSession({ userId, ttlSeconds?, ip?, ua?, tags? }) → { sessionToken, expiresAt }

   • auth.revokeSessions({ userId }|{ sessionId })

3. Flags / safety

   • authProvider: 'external' | 'password' | 'oauth', passwordDisabled: true

   • Audit log for user/session mutations; rate limits; service-role only.

Why it matters: Enables secure passwordless sign-in (Nostr, WebAuthn, …?), preserves Base44’s session model, and avoids custom shadow-user tables.

Acceptance criteria:

• I can create a built-in User from a backend function (service-role) after verifying an external proof, then immediately call auth.createSession and set a cookie for the client.

• Sessions appear in the dashboard and can be revoked.

Priority: High — blocks go-live of our Nostr login.

Context / Use case

• External auth flow (Nostr): client signs a challenge; backend verifies the signature; on success, the app must:
  a) upsert a built-in User keyed by externalId = nostr:npub…,
  b) start a Base44 session server-side,
  c) return a session token / set cookie.

• Current limitation: backend functions cannot use the built-in User schema nor start sessions.

Proposed APIs (service-role only)

Backward compatibility

• No changes for existing password/OAuth apps.

• Dashboard user mgmt remains the same; new sessions appear in the usual list.

Why Base44 benefits

• Unblocks passwordless / decentralized identity (Nostr, WebAuthn, …?).

• Reduces “shadow user” anti-patterns.

• Keeps developers on Base44 for auth instead of bolting on external session stacks.