feat: add User password hashing + account creation script

scripts/create-user.ts

@@ -0,0 +1,56 @@
+// Standalone CLI entry point for creating an internal auth account by hand:
+// `npx tsx scripts/create-user.ts --email [email protected] --name "Foo Bar" --password "..."`
+// There is deliberately no self-registration UI or public API route for
+// this — see src/lib/users.ts / prisma/schema.prisma's User model comment
+// for why (a handful of trusted IT staff accounts, not company-wide).
+import { createUser, validateCreateUserInput } from "../src/lib/users";
+import { prisma } from "../src/lib/prisma";
+
+function parseArgs(argv: string[]): Record<string, string> {
+  const args: Record<string, string> = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (!arg.startsWith("--")) {
+      continue;
+    }
+    const key = arg.slice(2);
+    const value = argv[i + 1];
+    if (value === undefined || value.startsWith("--")) {
+      throw new Error(`Missing value for --${key}`);
+    }
+    args[key] = value;
+    i += 1;
+  }
+  return args;
+}
+
+async function main(): Promise<void> {
+  const args = parseArgs(process.argv.slice(2));
+
+  const validation = validateCreateUserInput({
+    email: args.email,
+    name: args.name,
+    password: args.password,
+  });
+
+  if (!validation.ok) {
+    console.error(`Error: ${validation.error}`);
+    console.error(
+      'Usage: npx tsx scripts/create-user.ts --email [email protected] --name "Foo Bar" --password "..."'
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  const user = await createUser(validation.value);
+  console.log(`Created user ${user.email} (id: ${user.id})`);
+}
+
+main()
+  .catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+  })
+  .finally(async () => {
+    await prisma.$disconnect();
+  });