feat(m3): auth & user management with session, tests, and e2e

- Custom error classes (lib/errors.ts) and signed-cookie session
  (lib/auth/session.ts, HMAC-SHA256, httpOnly+sameSite=lax)
- UserRepository + AuthService (bcrypt hashing, role/status checks,
  register/login/logout/getCurrentUser/updateProfile)
- Auth helpers (getCurrentUser), user validator, API error handler
- API routes: register (auto-login), login, logout, me, PATCH users/me,
  GET admin/migrations (admin-only guard)
- middleware.ts redirects unauthenticated page access to /login
- Screens: login (login/register toggle), profile, dashboard skeleton,
  home redirect
- vitest: exclude e2e specs, setupFiles for SESSION_SECRET
- playwright: run migrate before dev server, set SESSION_SECRET
- Unit tests (UserRepository, AuthService, session), integration
  auth-flow, e2e auth.spec (register/login/logout/protected/401)

app/api/auth/login/route.ts

@@ -0,0 +1,34 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { AuthService } from '@/services/AuthService';
+import { UserRepository } from '@/repositories/UserRepository';
+import { getDb } from '@/lib/db/sqlite';
+import { toPublicUser } from '@/lib/auth/getCurrentUser';
+import { setSessionCookie } from '@/lib/auth/session';
+import { handleApiError, jsonError } from '@/lib/api/handleError';
+
+export const runtime = 'nodejs';
+
+export async function POST(request: NextRequest) {
+  let body: Record<string, unknown>;
+  try {
+    body = (await request.json()) as Record<string, unknown>;
+  } catch {
+    return jsonError(400, 'リクエスト本文が不正です');
+  }
+
+  const authService = new AuthService(new UserRepository(getDb()));
+  try {
+    const { user, token } = authService.login(
+      String(body.email ?? ''),
+      String(body.password ?? '')
+    );
+    const response = NextResponse.json(
+      { user: toPublicUser(user) },
+      { status: 200 }
+    );
+    setSessionCookie(response, token);
+    return response;
+  } catch (error) {
+    return handleApiError(error);
+  }
+}

app/api/auth/logout/route.ts

@@ -0,0 +1,10 @@
+import { NextResponse } from 'next/server';
+import { clearSessionCookie } from '@/lib/auth/session';
+
+export const runtime = 'nodejs';
+
+export async function POST() {
+  const response = NextResponse.json({ ok: true });
+  clearSessionCookie(response);
+  return response;
+}

app/api/auth/me/route.ts

@@ -0,0 +1,14 @@
+import { NextResponse } from 'next/server';
+import { getCurrentUser, toPublicUser } from '@/lib/auth/getCurrentUser';
+import { UnauthorizedError } from '@/lib/errors';
+import { handleApiError } from '@/lib/api/handleError';
+
+export const runtime = 'nodejs';
+
+export async function GET() {
+  const user = await getCurrentUser();
+  if (!user) {
+    return handleApiError(new UnauthorizedError());
+  }
+  return NextResponse.json({ user: toPublicUser(user) });
+}

app/api/auth/register/route.ts

@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { AuthService } from '@/services/AuthService';
+import { UserRepository } from '@/repositories/UserRepository';
+import { getDb } from '@/lib/db/sqlite';
+import { toPublicUser } from '@/lib/auth/getCurrentUser';
+import { createSessionToken, setSessionCookie } from '@/lib/auth/session';
+import { handleApiError, jsonError } from '@/lib/api/handleError';
+
+export const runtime = 'nodejs';
+
+export async function POST(request: NextRequest) {
+  let body: Record<string, unknown>;
+  try {
+    body = (await request.json()) as Record<string, unknown>;
+  } catch {
+    return jsonError(400, 'リクエスト本文が不正です');
+  }
+
+  const authService = new AuthService(new UserRepository(getDb()));
+  try {
+    const user = authService.register({
+      name: String(body.name ?? ''),
+      email: String(body.email ?? ''),
+      password: String(body.password ?? ''),
+    });
+    // 登録成功と同時にログイン(セッションCookieを設定)
+    const response = NextResponse.json(
+      { user: toPublicUser(user) },
+      { status: 201 }
+    );
+    setSessionCookie(response, createSessionToken(user.id));
+    return response;
+  } catch (error) {
+    return handleApiError(error);
+  }
+}