feat(m3): auth & user management with session, tests, and e2e

- Custom error classes (lib/errors.ts) and signed-cookie session
  (lib/auth/session.ts, HMAC-SHA256, httpOnly+sameSite=lax)
- UserRepository + AuthService (bcrypt hashing, role/status checks,
  register/login/logout/getCurrentUser/updateProfile)
- Auth helpers (getCurrentUser), user validator, API error handler
- API routes: register (auto-login), login, logout, me, PATCH users/me,
  GET admin/migrations (admin-only guard)
- middleware.ts redirects unauthenticated page access to /login
- Screens: login (login/register toggle), profile, dashboard skeleton,
  home redirect
- vitest: exclude e2e specs, setupFiles for SESSION_SECRET
- playwright: run migrate before dev server, set SESSION_SECRET
- Unit tests (UserRepository, AuthService, session), integration
  auth-flow, e2e auth.spec (register/login/logout/protected/401)

lib/auth/getCurrentUser.ts

@@ -0,0 +1,33 @@
+import { UserRepository } from '@/repositories/UserRepository';
+import { getDb } from '@/lib/db/sqlite';
+import { getSessionUserId } from '@/lib/auth/session';
+import type { User } from '@/lib/types';
+
+/**
+ * APIレスポンス等で外部に公開するユーザー情報（passwordHashを除く）
+ */
+export type PublicUser = Omit<User, 'passwordHash'>;
+
+export function toPublicUser(user: User): PublicUser {
+  return {
+    id: user.id,
+    name: user.name,
+    email: user.email,
+    avatarUrl: user.avatarUrl,
+    role: user.role,
+    status: user.status,
+    createdAt: user.createdAt,
+    updatedAt: user.updatedAt,
+  };
+}
+
+/**
+ * 現在のリクエストからログインユーザーを解決する。
+ * 未認証の場合は null を返す。
+ */
+export async function getCurrentUser(): Promise<User | null> {
+  const userId = await getSessionUserId();
+  if (userId === null) return null;
+  const userRepository = new UserRepository(getDb());
+  return userRepository.findById(userId);
+}