How to migrate from a custom auth system to a third-party provider

What is actually portable, how to import password hashes without forcing a reset, and how to cut over with a rollback you can trust.