Add authentication runtime milestone

docs/VELODY_ROADMAP.md

@@ -30,6 +30,7 @@ When milestone scope, sequencing, or status changes, update this file first.
 | 11.4 | Legacy Owner Claim & Transfer | Completed |
 | 11.5 | OAuth Identity Providers | Completed |
 | 11.6 | Device Management & Recovery | Completed |
+| 11.7 | Authentication Runtime Foundation | Planned |
 | 12 | Monetization | Planned |
 | 13 | Pro Features | Planned |
 
@@ -425,6 +426,27 @@ Completed.
 
 This milestone added internal account-scoped device management and recovery foundations, including safe device listing, device revocation, recovery token rotation, ownership validation, and DeviceLinkHistory audit records.
 
+## Milestone 11.7 Authentication Runtime Foundation
+
+**Goal**  
+Add the runtime authentication foundation needed before monetization, without changing the existing device-token music system.
+
+**Major features**
+
+- Email/password login runtime foundation.
+- OAuth callback/runtime flow foundation.
+- Access token and refresh token model.
+- Session lifecycle model.
+- Account-authenticated device linking entry point.
+- Token rotation and logout groundwork.
+- Authentication tests for account runtime behavior.
+
+**Current status**  
+Planned
+
+**Completion notes**  
+Not started yet. This milestone is the next planned step before monetization because billing and entitlements need a stable account authentication runtime.
+
 ## Milestone 12 Monetization
 
 **Goal**