feat(m3): auth & user management with session, tests, and e2e

- Custom error classes (lib/errors.ts) and signed-cookie session
  (lib/auth/session.ts, HMAC-SHA256, httpOnly+sameSite=lax)
- UserRepository + AuthService (bcrypt hashing, role/status checks,
  register/login/logout/getCurrentUser/updateProfile)
- Auth helpers (getCurrentUser), user validator, API error handler
- API routes: register (auto-login), login, logout, me, PATCH users/me,
  GET admin/migrations (admin-only guard)
- middleware.ts redirects unauthenticated page access to /login
- Screens: login (login/register toggle), profile, dashboard skeleton,
  home redirect
- vitest: exclude e2e specs, setupFiles for SESSION_SECRET
- playwright: run migrate before dev server, set SESSION_SECRET
- Unit tests (UserRepository, AuthService, session), integration
  auth-flow, e2e auth.spec (register/login/logout/protected/401)

app/api/users/me/route.ts

@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { AuthService } from '@/services/AuthService';
+import { UserRepository } from '@/repositories/UserRepository';
+import { getDb } from '@/lib/db/sqlite';
+import { getCurrentUser, toPublicUser } from '@/lib/auth/getCurrentUser';
+import { UnauthorizedError } from '@/lib/errors';
+import { handleApiError, jsonError } from '@/lib/api/handleError';
+
+export const runtime = 'nodejs';
+
+export async function PATCH(request: NextRequest) {
+  const currentUser = await getCurrentUser();
+  if (!currentUser) {
+    return handleApiError(new UnauthorizedError());
+  }
+
+  let body: Record<string, unknown>;
+  try {
+    body = (await request.json()) as Record<string, unknown>;
+  } catch {
+    return jsonError(400, 'リクエスト本文が不正です');
+  }
+
+  const authService = new AuthService(new UserRepository(getDb()));
+  try {
+    const updated = authService.updateProfile(currentUser.id, {
+      name: typeof body.name === 'string' ? body.name : undefined,
+      email: typeof body.email === 'string' ? body.email : undefined,
+      avatarUrl:
+        typeof body.avatarUrl === 'string' ? body.avatarUrl : undefined,
+    });
+    return NextResponse.json({ user: toPublicUser(updated) });
+  } catch (error) {
+    return handleApiError(error);
+  }
+}