feat: add User Prisma model + migration

prisma/schema.prisma

@@ -38,3 +38,21 @@ model Request {
 
   @@map("requests")
 }
+
+// Minimal internal auth accounts — NOT company SSO (deliberately ruled out,
+// see CLAUDE.md / auth decision notes). A handful of trusted IT staff
+// accounts, created by hand via scripts/create-user.ts, no self-registration.
+// Auth.js v5 Credentials provider + JWT session strategy is used, so this is
+// intentionally just a plain user table — no `Account`/`Session`/
+// `VerificationToken` models, those exist for OAuth account linking / DB
+// session strategy, neither of which applies here. No `role` field either:
+// permission model is flat for now (any logged-in user can do anything).
+model User {
+  id           String   @id @default(uuid()) @db.Uuid
+  email        String   @unique
+  passwordHash String   @map("password_hash")
+  name         String
+  createdAt    DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+
+  @@map("users")
+}