feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/incidents/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
+import { getSession } from '@/lib/auth/get-session'
 import { validateIncidentInput, validateTypeDetails, type IncidentType, type MedicalStatus } from '@/lib/incidents/validate'
 import { uploadEvidenceFile, type EvidenceStage } from '@/lib/supabase/storage'
 import { sendNewIncidentEmail } from '@/lib/notifications/email'
@@ -19,16 +20,16 @@ export async function POST(request: Request) {
 }
 
 async function handlePost(request: Request) {
+  const session = await getSession()
+  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
   const supabase = await createClient()
-  const { data, error: authError } = await supabase.auth.getUser()
-  if (authError || !data?.user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  const user = data.user
 
   const since = new Date(Date.now() - 60_000).toISOString()
   const { count: recentIncidents } = await supabase
     .from('audit_log')
     .select('id', { count: 'exact', head: true })
-    .eq('changed_by', user.id)
+    .eq('changed_by', session.sub)
     .eq('table_name', 'incidents')
     .eq('action', 'INSERT')
     .gte('changed_at', since)
@@ -106,7 +107,7 @@ async function handlePost(request: Request) {
       incident_type: input.incident_type,
       site_id: zone.site_id,
       zone_id: zone.id,
-      reported_by: user.id,
+      reported_by: session.sub,
       description: input.description.trim(),
       injury_involved: input.injury_involved,
       asset_involved: input.asset_involved,
@@ -133,14 +134,14 @@ async function handlePost(request: Request) {
 
   for (const file of files) {
     try {
-      const { publicUrl, hash } = await uploadEvidenceFile(supabase, file, incident.id, 'report')
+      const { publicUrl, hash } = await uploadEvidenceFile(supabase, file, incident.id, 'report', session.sub)
       evidenceRows.push({
         incident_id: incident.id,
         stage: 'report',
         file_url: publicUrl,
         file_type: file.type,
         file_hash: hash,
-        uploaded_by: user.id,
+        uploaded_by: session.sub,
       })
     } catch (err) {
       console.error('file upload error:', err)
@@ -155,7 +156,7 @@ async function handlePost(request: Request) {
     p_table_name: 'incidents',
     p_record_id: incident.id,
     p_action: 'INSERT',
-    p_new_value: { incident_type: input.incident_type, reported_by: user.id },
+    p_new_value: { incident_type: input.incident_type, reported_by: session.sub },
   })
 
   sendNewIncidentEmail(incident.id, zone.site_id, incident.reference_no ?? '', input.incident_type)