feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

components/account/change-password-form.tsx

@@ -1,7 +1,6 @@
 'use client'
 
 import { useState } from 'react'
-import { createClient } from '@/lib/supabase/client'
 
 export default function ChangePasswordForm() {
   const [current, setCurrent] = useState('')
@@ -35,32 +34,16 @@ export default function ChangePasswordForm() {
     }
 
     setLoading(true)
-    const supabase = createClient()
-
-    // Get current user email for re-auth
-    const { data: { user } } = await supabase.auth.getUser()
-    if (!user?.email) {
-      setError('Session expired, please log in again.')
-      setLoading(false)
-      return
-    }
-
-    // Re-authenticate with current password
-    const { error: reauthError } = await supabase.auth.signInWithPassword({
-      email: user.email,
-      password: current,
+    const res = await fetch('/api/auth/change-password', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ currentPassword: current, newPassword: newPass }),
     })
-    if (reauthError) {
-      setError('Current password is incorrect.')
-      setLoading(false)
-      return
-    }
+    setLoading(false)
 
-    // Update to new password
-    const { error: updateError } = await supabase.auth.updateUser({ password: newPass })
-    if (updateError) {
-      setError(updateError.message)
-      setLoading(false)
+    if (!res.ok) {
+      const data = await res.json()
+      setError(data.error ?? 'Password change failed.')
       return
     }
 
@@ -68,7 +51,6 @@ export default function ChangePasswordForm() {
     setNewPass('')
     setConfirm('')
     setSuccess(true)
-    setLoading(false)
   }
 
   return (