feat: split auth config into edge-safe auth.config.ts

auth.config.ts holds only the Edge-Runtime-safe parts of the Auth.js
config (session strategy, pages, jwt/session callbacks) with an empty
providers array. auth.ts spreads it and adds the real Credentials
provider on top for use in API routes/Server Components (Node runtime).

Needed for middleware.ts (next commit): the Credentials provider's
authorize() pulls in bcryptjs via verifyUserCredentials(), which is a
Node API not supported on the Edge Runtime that middleware.ts runs on.
Without this split, next build bundles bcryptjs/jose into the Edge
middleware chunk and warns; with it, the build is clean.

src/auth.config.ts

@@ -0,0 +1,40 @@
+import type { NextAuthConfig } from "next-auth";
+
+// Edge-safe subset of the full Auth.js config (src/auth.ts). Deliberately
+// has NO providers here: the Credentials provider's authorize() calls
+// verifyUserCredentials() (src/lib/users.ts), which pulls in bcryptjs — a
+// Node.js API, not Edge-Runtime-compatible (see
+// https://authjs.dev/guides/edge-compatibility). middleware.ts runs on the
+// Edge Runtime in this project's Next.js 14.2.35 and only ever needs to
+// decode/validate the JWT session cookie, never to run a provider's
+// authorize() — so it builds its own lightweight NextAuth instance from
+// just this config (see src/middleware.ts), instead of importing the full
+// src/auth.ts (which previously got bcryptjs/jose Node-API warnings bundled
+// into the Edge middleware build even though that code path never actually
+// ran there). src/auth.ts spreads this same config and adds the real
+// Credentials provider on top, for use everywhere else (API routes, Server
+// Components) where the Node.js runtime is available.
+export default {
+  // Required by NextAuthConfig's type, but deliberately empty here — the
+  // real Credentials provider is added in src/auth.ts, not here. See this
+  // file's top comment for why.
+  providers: [],
+  session: { strategy: "jwt" },
+  pages: {
+    signIn: "/login",
+  },
+  callbacks: {
+    jwt({ token, user }) {
+      if (user) {
+        token.id = user.id;
+      }
+      return token;
+    },
+    session({ session, token }) {
+      if (session.user) {
+        session.user.id = token.id as string;
+      }
+      return session;
+    },
+  },
+} satisfies NextAuthConfig;