feat(auth): Auth.js v5 + Postgres adapter for local smoke test

Wire up NextAuth v5 with @auth/pg-adapter, JWT sessions (edge-friendly),
and a dev Credentials provider for local testing without Google OAuth.

Stack
- next-auth@5.0.0-beta.31, @auth/pg-adapter@1.11.2, @types/pg
- Google OAuth provider via GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET
  (falls back to AUTH_GOOGLE_ID / AUTH_GOOGLE_SECRET)
- Postgres adapter wired to a single pg.Pool in src/lib/db.ts style —
  reads DATABASE_URL with SUPABASE_DB_URL / POSTGRES_URL fallbacks
- JWT session strategy (edge-safe) so the proxy can verify sessions
  without a DB round-trip

Files
- src/auth.config.ts        edge-safe config (Google + authorized cb)
- src/lib/auth.ts           server config (adapter + dev Credentials)
- src/proxy.ts              Next.js 16 proxy (was middleware.ts)
- src/app/api/auth/[...nextauth]/route.ts
                            catch-all handler
- src/app/protected-example/page.tsx
                            demo page that renders auth() session
- src/actions/auth-signin.ts
                            signInWithGoogle, signInWithDev,
                            signOutAction server actions
- src/app/login/LoginClient.tsx
                            added "Sign in with Google" + dev form
- supabase/migrations/204_authjs_tables.sql
                            users / accounts / sessions /
                            verification_token schema (UUID-keyed)
- .env.example              AUTH_SECRET, AUTH_URL, GOOGLE_CLIENT_*,
                            DATABASE_URL, ALLOW_DEV_LOGIN

Removed
- src/middleware.ts         deleted; Next.js 16 only runs one proxy
                            (the new src/proxy.ts is canonical)

Routes
- /login, /admin, /admin/*, /protected-example
                            proxy matcher
- /api/auth/{providers,csrf,signin/<provider>,callback/<provider>,
  session,signout}
                            standard Auth.js endpoints

Local dev
- npm run dev (now runs on port 4000)
- push migration 204 then visit /login
- dev signin works with any non-empty username/password
  (hidden when ALLOW_DEV_LOGIN=false)
- Google signin requires real GOOGLE_CLIENT_ID + redirect URI
  http://localhost:4000/api/auth/callback/google

Verified
- tsc --noEmit clean
- /admin, /admin/orders, /protected-example → 307 to /login
  when unauthenticated
- /api/auth/session returns user after signin
- /protected-example renders session info
- /api/auth/providers returns google + dev-login

Docs
- CLAUDE.md and MEMORY.md updated to reflect the Supabase → Postgres
  + Auth.js v5 pivot

Gradual migration in progress
- src/lib/admin-permissions.ts still uses dev_session / rc_auth_uid;
  the admin shell will show 'Access Denied' for Auth.js-only
  sessions until each page is flipped over
- @supabase/* packages remain in package.json for the same reason
- production deployment (AUTH_URL=https://, __Secure- cookies) is
  out of scope for this pass

src/actions/auth-signin.ts

@@ -0,0 +1,56 @@
+"use server";
+
+import { signIn, signOut } from "@/lib/auth";
+import { AuthError } from "next-auth";
+
+/**
+ * Server actions that wrap the Auth.js v5 `signIn` / `signOut` API for
+ * use from client components.
+ *
+ * Why server actions?
+ *   • The Auth.js v5 `signIn` function has to run on the server (it
+ *     needs to set the session cookie, talk to the database adapter,
+ *     and redirect the user to the OAuth provider).
+ *   • Calling it from a client component via a server action keeps the
+ *     client bundle small and avoids exposing the OAuth client secret.
+ *
+ * Usage from a client component:
+ *   <form action={signInWithGoogle}>
+ *     <button type="submit">Sign in with Google</button>
+ *   </form>
+ *
+ * Usage for the dev credentials provider (dev only):
+ *   <form action={signInWithDev}>
+ *     <input name="username" />
+ *     <input name="password" type="password" />
+ *     <button type="submit">Dev login</button>
+ *   </form>
+ */
+
+export async function signInWithGoogle(): Promise<void> {
+  await signIn("google", { redirectTo: "/admin" });
+}
+
+export async function signInWithDev(formData: FormData): Promise<void> {
+  const username = String(formData.get("username") ?? "admin");
+  const password = String(formData.get("password") ?? "dev");
+  try {
+    await signIn("dev-login", {
+      username,
+      password,
+      redirectTo: "/admin",
+    });
+  } catch (e) {
+    // signIn() throws a `NEXT_REDIRECT` to navigate — let that through
+    // so the redirect actually happens. Re-throw any other error so the
+    // caller can render a meaningful message.
+    if (e instanceof AuthError) {
+      throw new Error(`Dev sign-in failed: ${e.type}`);
+    }
+    throw e;
+  }
+}
+
+export async function signOutAction(): Promise<void> {
+  await signOut({ redirectTo: "/login" });
+}