feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

components/account/change-password-form.tsx

@@ -1,7 +1,6 @@
 'use client'
 
 import { useState } from 'react'
-import { createClient } from '@/lib/supabase/client'
 
 export default function ChangePasswordForm() {
   const [current, setCurrent] = useState('')
@@ -35,32 +34,16 @@ export default function ChangePasswordForm() {
     }
 
     setLoading(true)
-    const supabase = createClient()
-
-    // Get current user email for re-auth
-    const { data: { user } } = await supabase.auth.getUser()
-    if (!user?.email) {
-      setError('Session expired, please log in again.')
-      setLoading(false)
-      return
-    }
-
-    // Re-authenticate with current password
-    const { error: reauthError } = await supabase.auth.signInWithPassword({
-      email: user.email,
-      password: current,
+    const res = await fetch('/api/auth/change-password', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ currentPassword: current, newPassword: newPass }),
     })
-    if (reauthError) {
-      setError('Current password is incorrect.')
-      setLoading(false)
-      return
-    }
+    setLoading(false)
 
-    // Update to new password
-    const { error: updateError } = await supabase.auth.updateUser({ password: newPass })
-    if (updateError) {
-      setError(updateError.message)
-      setLoading(false)
+    if (!res.ok) {
+      const data = await res.json()
+      setError(data.error ?? 'Password change failed.')
       return
     }
 
@@ -68,7 +51,6 @@ export default function ChangePasswordForm() {
     setNewPass('')
     setConfirm('')
     setSuccess(true)
-    setLoading(false)
   }
 
   return (

components/auth/login-form.tsx

@@ -4,7 +4,6 @@
 import { useState } from 'react'
 import { useRouter } from 'next/navigation'
 import Link from 'next/link'
-import { createClient } from '@/lib/supabase/client'
 
 export function LoginForm() {
   const [email, setEmail] = useState('')
@@ -18,15 +17,21 @@ export function LoginForm() {
     setLoading(true)
     setError(null)
 
-    const supabase = createClient()
-    const { error } = await supabase.auth.signInWithPassword({ email, password })
+    const res = await fetch('/api/auth/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email, password }),
+    })
 
-    if (error) {
-      setError(error.message)
+    if (!res.ok) {
+      const data = await res.json()
+      setError(data.error ?? 'Login failed')
       setLoading(false)
       return
     }
 
+    // Middleware will redirect to correct role home based on JWT
+    router.push('/')
     router.refresh()
   }
 

components/layout/sidebar.tsx

@@ -2,7 +2,6 @@
 
 import Link from 'next/link'
 import { usePathname, useRouter } from 'next/navigation'
-import { createBrowserClient } from '@supabase/ssr'
 import { NotificationBell } from '@/components/notifications/bell'
 
 interface NavItem {
@@ -137,12 +136,9 @@ export function Sidebar({ role, userName, userEmail }: SidebarProps) {
   const mobileItems = items.slice(0, 4)
 
   const logout = async () => {
-    const supabase = createBrowserClient(
-      process.env.NEXT_PUBLIC_SUPABASE_URL!,
-      process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
-    )
-    await supabase.auth.signOut()
+    await fetch('/api/auth/logout', { method: 'POST' })
     router.push('/login')
+    router.refresh()
   }
 
   const displayName = userName || userEmail || 'User'