feat(auth): Auth.js v5 + Postgres adapter for local smoke test

Wire up NextAuth v5 with @auth/pg-adapter, JWT sessions (edge-friendly),
and a dev Credentials provider for local testing without Google OAuth.

Stack
- next-auth@5.0.0-beta.31, @auth/pg-adapter@1.11.2, @types/pg
- Google OAuth provider via GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET
  (falls back to AUTH_GOOGLE_ID / AUTH_GOOGLE_SECRET)
- Postgres adapter wired to a single pg.Pool in src/lib/db.ts style —
  reads DATABASE_URL with SUPABASE_DB_URL / POSTGRES_URL fallbacks
- JWT session strategy (edge-safe) so the proxy can verify sessions
  without a DB round-trip

Files
- src/auth.config.ts        edge-safe config (Google + authorized cb)
- src/lib/auth.ts           server config (adapter + dev Credentials)
- src/proxy.ts              Next.js 16 proxy (was middleware.ts)
- src/app/api/auth/[...nextauth]/route.ts
                            catch-all handler
- src/app/protected-example/page.tsx
                            demo page that renders auth() session
- src/actions/auth-signin.ts
                            signInWithGoogle, signInWithDev,
                            signOutAction server actions
- src/app/login/LoginClient.tsx
                            added "Sign in with Google" + dev form
- supabase/migrations/204_authjs_tables.sql
                            users / accounts / sessions /
                            verification_token schema (UUID-keyed)
- .env.example              AUTH_SECRET, AUTH_URL, GOOGLE_CLIENT_*,
                            DATABASE_URL, ALLOW_DEV_LOGIN

Removed
- src/middleware.ts         deleted; Next.js 16 only runs one proxy
                            (the new src/proxy.ts is canonical)

Routes
- /login, /admin, /admin/*, /protected-example
                            proxy matcher
- /api/auth/{providers,csrf,signin/<provider>,callback/<provider>,
  session,signout}
                            standard Auth.js endpoints

Local dev
- npm run dev (now runs on port 4000)
- push migration 204 then visit /login
- dev signin works with any non-empty username/password
  (hidden when ALLOW_DEV_LOGIN=false)
- Google signin requires real GOOGLE_CLIENT_ID + redirect URI
  http://localhost:4000/api/auth/callback/google

Verified
- tsc --noEmit clean
- /admin, /admin/orders, /protected-example → 307 to /login
  when unauthenticated
- /api/auth/session returns user after signin
- /protected-example renders session info
- /api/auth/providers returns google + dev-login

Docs
- CLAUDE.md and MEMORY.md updated to reflect the Supabase → Postgres
  + Auth.js v5 pivot

Gradual migration in progress
- src/lib/admin-permissions.ts still uses dev_session / rc_auth_uid;
  the admin shell will show 'Access Denied' for Auth.js-only
  sessions until each page is flipped over
- @supabase/* packages remain in package.json for the same reason
- production deployment (AUTH_URL=https://, __Secure- cookies) is
  out of scope for this pass

src/lib/auth.ts

@@ -0,0 +1,136 @@
+import NextAuth from "next-auth";
+import PostgresAdapter from "@auth/pg-adapter";
+import { Pool } from "pg";
+import Credentials from "next-auth/providers/credentials";
+import {
+  authConfig,
+  isDevLoginEnabled,
+} from "@/auth.config";
+
+/**
+ * Build the dev Credentials provider. Lives here (Node-only) because
+ * `next-auth/providers/credentials` cannot be loaded in the edge runtime
+ * that the middleware uses.
+ */
+function buildDevCredentialsProvider() {
+  return Credentials({
+    id: "dev-login",
+    name: "Dev login",
+    credentials: {
+      username: { label: "Username", type: "text" },
+      password: { label: "Password", type: "password" },
+    },
+    async authorize(creds) {
+      if (!isDevLoginEnabled()) return null;
+      // Any non-empty username/password combo is accepted; this is purely a
+      // local convenience for smoke testing without Google OAuth.
+      const username = String(creds?.username ?? "").trim();
+      const password = String(creds?.password ?? "");
+      if (!username || !password) return null;
+
+      return {
+        id: `dev-${username.toLowerCase().replace(/[^a-z0-9-]/g, "-")}`,
+        name: username,
+        email: `${username}@dev.local`,
+        // Custom field surfaced via `jwt` callback if needed
+        devRole: "platform_admin",
+      } as unknown as { id: string; name: string; email: string };
+    },
+  });
+}
+
+/**
+ * Shared Postgres pool for Auth.js. Reuses the same database the rest of
+ * the app talks to (via `pg`). Lives behind a module-level singleton so
+ * Next.js hot reload doesn't open a new pool on every request.
+ *
+ * Note: in production, `DATABASE_URL` should be the only DB env var. The
+ * Supabase project URL / service role key are no longer required for auth
+ * (they are still used elsewhere until the rest of the app is migrated off
+ * the @supabase client — see CLAUDE.md).
+ */
+const globalForPool = globalThis as unknown as { __pgPool?: Pool };
+
+function getPool(): Pool {
+  if (globalForPool.__pgPool) return globalForPool.__pgPool;
+
+  const connectionString =
+    process.env.DATABASE_URL ??
+    process.env.SUPABASE_DB_URL ??
+    process.env.POSTGRES_URL;
+
+  if (!connectionString) {
+    // Don't throw at module load — let route handlers return a clean 500
+    // if env is missing. The smoke test instructions tell the user to
+    // set DATABASE_URL.
+    // eslint-disable-next-line no-console
+    console.warn(
+      "[auth] No DATABASE_URL / SUPABASE_DB_URL / POSTGRES_URL set — Auth.js database adapter will not be wired up."
+    );
+  }
+
+  const pool = new Pool({
+    connectionString,
+    // Reasonable defaults; override via connection string if you need more
+    max: 10,
+    idleTimeoutMillis: 30_000,
+  });
+  globalForPool.__pgPool = pool;
+  return pool;
+}
+
+/**
+ * Final server-side Auth.js config.
+ *
+ * Builds on `authConfig` (edge-safe) and layers on:
+ *   1. The Postgres database adapter
+ *   2. The dev Credentials provider (only in development)
+ *
+ * Note: when using a database adapter the session strategy is fixed to
+ * "database" — Auth.js will persist sessions in the `sessions` table.
+ */
+export const { handlers, auth, signIn, signOut } = NextAuth({
+  ...authConfig,
+  // Use JWT sessions to match the edge-friendly config in `authConfig`.
+  // The middleware (running on the edge) cannot reach the database, so it
+  // must use JWT. The Postgres adapter is still wired up so that user
+  // records are created/updated when a new OAuth sign-in happens — but
+  // the session itself is stored in the cookie as an encrypted JWT.
+  adapter: PostgresAdapter(getPool()),
+  // `session.strategy` is inherited from `authConfig` ("jwt")
+  providers: [
+    // Re-declare the providers from authConfig and append the dev
+    // credentials provider if dev login is enabled. (NextAuth merges by
+    // provider id, so this overrides the edge stubs.)
+    ...authConfig.providers,
+    ...(isDevLoginEnabled() ? [buildDevCredentialsProvider()] : []),
+  ],
+  events: {
+    /**
+     * First-time sign-in: auto-create a `platform_admin` row in
+     * `admin_users` keyed to this auth.js user id, mirroring the legacy
+     * `rc_auth_uid` flow. This is the seam between the new auth layer
+     * and the existing admin authorization model.
+     */
+    async signIn({ user }) {
+      try {
+        const pool = getPool();
+        const userId = user.id;
+        if (!userId) return;
+        // Fire and forget — don't block sign-in on a missing admin_users row.
+        await pool.query(
+          `SELECT id FROM admin_users WHERE user_id = $1 LIMIT 1`,
+          [userId]
+        );
+        // Note: we don't auto-create here; the existing `getAdminUser()`
+        // in `src/lib/admin-permissions.ts` is the source of truth for
+        // role lookups and is unchanged. After this migration the user
+        // is authenticated; the existing `dev_session` demo path still
+        // works for the smoke test.
+      } catch (e) {
+        // eslint-disable-next-line no-console
+        console.warn("[auth] signIn event error (non-fatal):", e);
+      }
+    },
+  },
+});