feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/auth/reset-confirm/route.ts

@@ -0,0 +1,41 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { asAdmin } from '@/lib/db/with-user'
+import { users, passwordResetTokens } from '@/lib/db/schema'
+import { eq, and, gt, isNull } from 'drizzle-orm'
+import { createHash } from 'crypto'
+import { hashPassword } from '@/lib/auth/password'
+
+export async function POST(req: NextRequest) {
+  const { token, password } = await req.json()
+  if (!token || !password || password.length < 8) {
+    return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
+  }
+
+  const tokenHash = createHash('sha256').update(token).digest('hex')
+  const now = new Date()
+
+  const [row] = await asAdmin(db =>
+    db.select({ id: passwordResetTokens.id, userId: passwordResetTokens.userId })
+      .from(passwordResetTokens)
+      .where(and(
+        eq(passwordResetTokens.tokenHash, tokenHash),
+        gt(passwordResetTokens.expiresAt, now),
+        isNull(passwordResetTokens.usedAt),
+      )).limit(1)
+  )
+
+  if (!row) {
+    return NextResponse.json({ error: 'Invalid or expired token' }, { status: 400 })
+  }
+
+  const newHash = await hashPassword(password)
+
+  await asAdmin(async db => {
+    await db.update(users).set({ passwordHash: newHash }).where(eq(users.id, row.userId))
+    await db.update(passwordResetTokens).set({ usedAt: now }).where(eq(passwordResetTokens.id, row.id))
+  })
+
+  return NextResponse.json({ ok: true })
+}