feat(m3): auth & user management with session, tests, and e2e

- Custom error classes (lib/errors.ts) and signed-cookie session
  (lib/auth/session.ts, HMAC-SHA256, httpOnly+sameSite=lax)
- UserRepository + AuthService (bcrypt hashing, role/status checks,
  register/login/logout/getCurrentUser/updateProfile)
- Auth helpers (getCurrentUser), user validator, API error handler
- API routes: register (auto-login), login, logout, me, PATCH users/me,
  GET admin/migrations (admin-only guard)
- middleware.ts redirects unauthenticated page access to /login
- Screens: login (login/register toggle), profile, dashboard skeleton,
  home redirect
- vitest: exclude e2e specs, setupFiles for SESSION_SECRET
- playwright: run migrate before dev server, set SESSION_SECRET
- Unit tests (UserRepository, AuthService, session), integration
  auth-flow, e2e auth.spec (register/login/logout/protected/401)

lib/validators/userValidator.ts

@@ -0,0 +1,95 @@
+import { ValidationError } from '@/lib/errors';
+
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const MAX_NAME_LENGTH = 100;
+const MIN_PASSWORD_LENGTH = 8;
+const MAX_AVATAR_URL_LENGTH = 500;
+
+export interface RegisterInput {
+  name: string;
+  email: string;
+  password: string;
+}
+
+export interface LoginInput {
+  email: string;
+  password: string;
+}
+
+export interface ProfileUpdateInput {
+  name?: string;
+  email?: string;
+  avatarUrl?: string;
+}
+
+export function validateRegister(input: RegisterInput): void {
+  validateName(input.name);
+  validateEmail(input.email);
+  validatePassword(input.password);
+}
+
+export function validateLogin(input: LoginInput): void {
+  if (!input.email) {
+    throw new ValidationError('メールアドレスを入力してください', 'email');
+  }
+  if (!input.password) {
+    throw new ValidationError('パスワードを入力してください', 'password');
+  }
+}
+
+export function validateProfileUpdate(input: ProfileUpdateInput): void {
+  if (
+    input.name === undefined &&
+    input.email === undefined &&
+    input.avatarUrl === undefined
+  ) {
+    throw new ValidationError('更新対象のフィールドを指定してください');
+  }
+  if (input.name !== undefined) validateName(input.name);
+  if (input.email !== undefined) validateEmail(input.email);
+  if (
+    input.avatarUrl !== undefined &&
+    input.avatarUrl.length > MAX_AVATAR_URL_LENGTH
+  ) {
+    throw new ValidationError(
+      `アイコン画像URLは${MAX_AVATAR_URL_LENGTH}文字以内で入力してください`,
+      'avatarUrl'
+    );
+  }
+}
+
+function validateName(name: string): void {
+  if (!name || !name.trim()) {
+    throw new ValidationError('表示名を入力してください', 'name');
+  }
+  if (name.length > MAX_NAME_LENGTH) {
+    throw new ValidationError(
+      `表示名は${MAX_NAME_LENGTH}文字以内で入力してください`,
+      'name'
+    );
+  }
+}
+
+function validateEmail(email: string): void {
+  if (!email) {
+    throw new ValidationError('メールアドレスを入力してください', 'email');
+  }
+  if (!EMAIL_RE.test(email)) {
+    throw new ValidationError(
+      'メールアドレスの形式が正しくありません',
+      'email'
+    );
+  }
+}
+
+function validatePassword(password: string): void {
+  if (!password) {
+    throw new ValidationError('パスワードを入力してください', 'password');
+  }
+  if (password.length < MIN_PASSWORD_LENGTH) {
+    throw new ValidationError(
+      `パスワードは${MIN_PASSWORD_LENGTH}文字以上で入力してください`,
+      'password'
+    );
+  }
+}