feat(auth): wire Credentials provider + edge-safe authConfig

- src/auth.config.ts: edge-safe Auth.js config (no pg, no Credentials)
  imported by the middleware; exports authConfig + isDevLoginEnabled
- src/lib/auth.ts: extends authConfig with the Credentials provider
  (Node-only) for email + password sign-in via users.password_hash
- src/middleware.ts: uses authConfig (edge-safe) instead of the full
  src/lib/auth.ts so the edge bundle stays small
- src/actions/auth-actions.ts: adds signInWithCredentials that calls
  the Credentials provider; signInWithGoogle stays the production path

src/actions/auth-actions.ts

@@ -2,20 +2,40 @@
 
 import "server-only";
 import { signIn, signOut } from "@/lib/auth";
+import { redirect } from "next/navigation";
 
 /**
  * Kick off the Google OAuth flow. Auth.js will redirect to Google's
  * consent screen and then back to /api/auth/callback/google, which sets
  * the session cookie and redirects to /admin.
- *
- * The historical Supabase-backed email/password sign-in action was
- * removed in the cleanup pass. Admin accounts are provisioned by an
- * existing platform admin via /admin/users.
  */
 export async function signInWithGoogle(): Promise<void> {
   await signIn("google", { redirectTo: "/admin" });
 }
 
+/**
+ * Sign in with email + password. The `credentials` provider is enabled
+ * in dev (see `isDevLoginEnabled()` in `src/auth.config.ts`); in
+ * production it is omitted entirely and this action returns an
+ * `AuthError` (Auth.js surfaces `?error=Configuration` on /login).
+ *
+ * On a failed credential check Auth.js redirects back to
+ * /login?error=CredentialsSignin, which the LoginClient renders as
+ * "Invalid email or password."
+ */
+export async function signInWithCredentials(formData: FormData): Promise<void> {
+  const email = String(formData.get("email") ?? "").trim().toLowerCase();
+  const password = String(formData.get("password") ?? "");
+  if (!email || !password) {
+    redirect("/login?error=MissingCredentials");
+  }
+  await signIn("credentials", {
+    email,
+    password,
+    redirectTo: "/admin",
+  });
+}
+
 /**
  * Sign out and clear the Auth.js session cookie.
  */