feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose

Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/lib/auth/session.test.ts

@@ -0,0 +1,26 @@
+// @vitest-environment node
+import { describe, it, expect, beforeAll } from 'vitest'
+
+// Set JWT_SECRET before importing the module
+beforeAll(() => {
+  process.env.JWT_SECRET = 'test-secret-at-least-32-characters-long'
+})
+
+import { createSession, verifySession } from '../../../lib/auth/session'
+
+describe('session', () => {
+  const payload = { sub: 'user-1', role: 'hse', siteId: null, name: 'Test User' }
+
+  it('creates a verifiable JWT', async () => {
+    const token = await createSession(payload)
+    const decoded = await verifySession(token)
+    expect(decoded).not.toBeNull()
+    expect(decoded?.sub).toBe(payload.sub)
+    expect(decoded?.role).toBe(payload.role)
+  })
+
+  it('returns null for invalid token', async () => {
+    const result = await verifySession('not.a.valid.jwt')
+    expect(result).toBeNull()
+  })
+})