feat: add Auth.js Credentials login config + route

src/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,3 @@
+import { handlers } from "@/auth";
+
+export const { GET, POST } = handlers;

src/auth.ts

@@ -0,0 +1,48 @@
+import NextAuth from "next-auth";
+import Credentials from "next-auth/providers/credentials";
+import { verifyUserCredentials } from "@/lib/users";
+
+// Minimal internal auth — Auth.js v5 (next-auth@beta) Credentials provider
+// only, no OAuth/SSO providers (company SSO was explicitly ruled out — see
+// prisma/schema.prisma's User model comment / CLAUDE.md). JWT session
+// strategy, not database sessions, so no adapter is configured here — the
+// Credentials provider's authorize() talks to Postgres directly via
+// verifyUserCredentials() (src/lib/users.ts), and the User table has no
+// Account/Session/VerificationToken rows to manage.
+//
+// Permission model is flat: any logged-in user can do anything, so the
+// session only needs to carry the user's id (used to identify who did what,
+// not to gate what they can do) — see the module augmentation in
+// src/types/next-auth.d.ts.
+export const { handlers, signIn, signOut, auth } = NextAuth({
+  session: { strategy: "jwt" },
+  pages: {
+    signIn: "/login",
+  },
+  providers: [
+    Credentials({
+      credentials: {
+        email: {},
+        password: {},
+      },
+      authorize: async (credentials) => {
+        const user = await verifyUserCredentials(credentials?.email, credentials?.password);
+        return user;
+      },
+    }),
+  ],
+  callbacks: {
+    jwt({ token, user }) {
+      if (user) {
+        token.id = user.id;
+      }
+      return token;
+    },
+    session({ session, token }) {
+      if (session.user) {
+        session.user.id = token.id as string;
+      }
+      return session;
+    },
+  },
+});

src/types/next-auth.d.ts

@@ -0,0 +1,14 @@
+import type { DefaultSession } from "next-auth";
+
+// Auth.js v5's default Session["user"] shape (name/email/image) doesn't
+// include `id`. src/auth.ts's jwt/session callbacks copy the user id from
+// the Credentials provider's authorize() result through to the session, so
+// callers can identify who's logged in — this augmentation makes that
+// typed instead of requiring a cast everywhere it's read.
+declare module "next-auth" {
+  interface Session {
+    user: {
+      id: string;
+    } & DefaultSession["user"];
+  }
+}