feat: add Auth.js Credentials login config + route

src/types/next-auth.d.ts

@@ -0,0 +1,14 @@
+import type { DefaultSession } from "next-auth";
+
+// Auth.js v5's default Session["user"] shape (name/email/image) doesn't
+// include `id`. src/auth.ts's jwt/session callbacks copy the user id from
+// the Credentials provider's authorize() result through to the session, so
+// callers can identify who's logged in — this augmentation makes that
+// typed instead of requiring a cast everywhere it's read.
+declare module "next-auth" {
+  interface Session {
+    user: {
+      id: string;
+    } & DefaultSession["user"];
+  }
+}