feat(m3): auth & user management with session, tests, and e2e

- Custom error classes (lib/errors.ts) and signed-cookie session
  (lib/auth/session.ts, HMAC-SHA256, httpOnly+sameSite=lax)
- UserRepository + AuthService (bcrypt hashing, role/status checks,
  register/login/logout/getCurrentUser/updateProfile)
- Auth helpers (getCurrentUser), user validator, API error handler
- API routes: register (auto-login), login, logout, me, PATCH users/me,
  GET admin/migrations (admin-only guard)
- middleware.ts redirects unauthenticated page access to /login
- Screens: login (login/register toggle), profile, dashboard skeleton,
  home redirect
- vitest: exclude e2e specs, setupFiles for SESSION_SECRET
- playwright: run migrate before dev server, set SESSION_SECRET
- Unit tests (UserRepository, AuthService, session), integration
  auth-flow, e2e auth.spec (register/login/logout/protected/401)

app/api/admin/migrations/route.ts

@@ -0,0 +1,27 @@
+import path from 'node:path';
+import { NextResponse } from 'next/server';
+import { Migrator } from '@/lib/db/migrator';
+import { getDb } from '@/lib/db/sqlite';
+import { getCurrentUser } from '@/lib/auth/getCurrentUser';
+import { UnauthorizedError, ForbiddenError } from '@/lib/errors';
+import { handleApiError } from '@/lib/api/handleError';
+
+export const runtime = 'nodejs';
+
+export async function GET() {
+  const user = await getCurrentUser();
+  if (!user) {
+    return handleApiError(new UnauthorizedError());
+  }
+  if (user.role !== 'system_admin') {
+    return handleApiError(new ForbiddenError('管理者のみアクセス可能です'));
+  }
+
+  try {
+    const migrationsDir = path.join(process.cwd(), 'lib', 'db', 'migrations');
+    const migrator = new Migrator(getDb(), migrationsDir);
+    return NextResponse.json({ migrations: migrator.getAppliedMigrations() });
+  } catch (error) {
+    return handleApiError(error);
+  }
+}