Roda is as lightweight as it gets, when it comes to ruby web routers. If you're worried about heavy dependencies, you should probably look into rails first.
Yes, Rails is a heavy framework. But strapping another framework on top of rails just for authentication smells pretty bad.
The reality may be different, but superficially it seems odd.
Roda is not a full blown framework. The footprint of rodauth overall is quite low, when compared. Couple that with the fact that you get 2 factors, sms, otp, webauthn, json mode, argon2, along with json mode + an array of security and usability features, from a single dependency.