auth.config.ts holds only the Edge-Runtime-safe parts of the Auth.js
config (session strategy, pages, jwt/session callbacks) with an empty
providers array. auth.ts spreads it and adds the real Credentials
provider on top for use in API routes/Server Components (Node runtime).
Needed for middleware.ts (next commit): the Credentials provider's
authorize() pulls in bcryptjs via verifyUserCredentials(), which is a
Node API not supported on the Edge Runtime that middleware.ts runs on.
Without this split, next build bundles bcryptjs/jose into the Edge
middleware chunk and warns; with it, the build is clean.
- dev/test Postgres stays local per-machine, not exposed
- prod (home Proxmox) Postgres stays private, cross-machine access via VPN/SSH tunnel
- keep db + app services in a single docker-compose.yml (already uses explicit
network/volume/container names, so splitting later stays cheap if a real
second consumer of the DB shows up)
- docs/asset-license-management.md (moved from ../processes/, fixed
relative links to stay accurate from the new location)
- CLAUDE.md now points at docs/asset-license-management.md
- removed stale no-git-repo-yet note, added git init/push status
toanhoang