Yes, the DB is SQLite. We chose it among others as it is file based and thus you get get up and running in seconds.
Authentication and authorization are key features, I agree. They were not integrated in the POC but they will come very soon. There actually is auth for the admin panel, I just need to standardize it for other entities.
I got it for the CMS use case, Manifest's aim is not to be a competitor of large frameworks that gives you the control of everything. We rather think that it will fit for another typology of projects. You can use it as a headless CMS, but there already is products like Strapi or Directus that get the job done. I am thinking more about projects with more "app" logic, but the next step is adding custom logic to it.