feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/(auth)/forgot-password/page.tsx

@@ -2,36 +2,25 @@
 
 import { useState } from 'react'
 import Link from 'next/link'
-import { createClient } from '@/lib/supabase/client'
 
 export default function ForgotPasswordPage() {
   const [email, setEmail] = useState('')
   const [loading, setLoading] = useState(false)
   const [submitted, setSubmitted] = useState(false)
-  const [error, setError] = useState<string | null>(null)
 
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault()
     if (!email) return
     setLoading(true)
-    setError(null)
 
-    const supabase = createClient()
-    const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? ''
-    const redirectTo = `${appUrl}/api/auth/callback?next=/reset-password`
-
-    const { error: resetError } = await supabase.auth.resetPasswordForEmail(email, {
-      redirectTo,
+    await fetch('/api/auth/reset-request', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email }),
     })
 
     setLoading(false)
-
-    if (resetError) {
-      setError('Something went wrong. Please try again.')
-      return
-    }
-
-    // Always show success — never reveal whether email exists
+    // Always show "check your email" regardless of response (silent for non-existent users)
     setSubmitted(true)
   }
 
@@ -61,12 +50,6 @@ export default function ForgotPasswordPage() {
           </p>
         </div>
 
-        {error && (
-          <p className="bg-red-50 border border-red-200 text-red-700 text-sm rounded px-3 py-2">
-            {error}
-          </p>
-        )}
-
         <input
           type="email"
           placeholder="Email"

app/(auth)/reset-password/page.tsx

@@ -1,24 +1,16 @@
 'use client'
 
-import { useState, useEffect } from 'react'
-import { useRouter } from 'next/navigation'
+import { useState } from 'react'
+import { useRouter, useSearchParams } from 'next/navigation'
 import Link from 'next/link'
-import { createClient } from '@/lib/supabase/client'
 
 export default function ResetPasswordPage() {
   const router = useRouter()
+  const searchParams = useSearchParams()
   const [password, setPassword] = useState('')
   const [confirm, setConfirm] = useState('')
   const [loading, setLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
-  const [sessionReady, setSessionReady] = useState<boolean | null>(null)
-
-  useEffect(() => {
-    const supabase = createClient()
-    supabase.auth.getSession().then(({ data: { session } }) => {
-      setSessionReady(!!session)
-    })
-  }, [])
 
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault()
@@ -34,39 +26,19 @@ export default function ResetPasswordPage() {
     }
 
     setLoading(true)
-    const supabase = createClient()
-    const { error: updateError } = await supabase.auth.updateUser({ password })
+    const res = await fetch('/api/auth/reset-confirm', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ token: searchParams.get('token'), password }),
+    })
     setLoading(false)
 
-    if (updateError) {
-      setError('Reset link has expired. Request a new one.')
-      return
+    if (res.ok) {
+      router.push('/login?reset=success')
+    } else {
+      const data = await res.json()
+      setError(data.error ?? 'Reset failed')
     }
-
-    router.push('/login?message=password_reset')
-  }
-
-  if (sessionReady === null) {
-    return (
-      <div className="flex min-h-screen items-center justify-center bg-gray-50 px-4">
-        <p className="text-sm text-gray-500">Loading…</p>
-      </div>
-    )
-  }
-
-  if (!sessionReady) {
-    return (
-      <div className="flex min-h-screen items-center justify-center bg-gray-50 px-4">
-        <div className="w-full max-w-sm text-center space-y-3">
-          <p className="bg-red-50 border border-red-200 text-red-700 text-sm rounded px-3 py-2">
-            Reset link has expired or is invalid.
-          </p>
-          <Link href="/forgot-password" className="text-sm text-blue-600 hover:underline">
-            Request a new reset link
-          </Link>
-        </div>
-      </div>
-    )
   }
 
   return (