feat(m3): auth & user management with session, tests, and e2e

- Custom error classes (lib/errors.ts) and signed-cookie session
  (lib/auth/session.ts, HMAC-SHA256, httpOnly+sameSite=lax)
- UserRepository + AuthService (bcrypt hashing, role/status checks,
  register/login/logout/getCurrentUser/updateProfile)
- Auth helpers (getCurrentUser), user validator, API error handler
- API routes: register (auto-login), login, logout, me, PATCH users/me,
  GET admin/migrations (admin-only guard)
- middleware.ts redirects unauthenticated page access to /login
- Screens: login (login/register toggle), profile, dashboard skeleton,
  home redirect
- vitest: exclude e2e specs, setupFiles for SESSION_SECRET
- playwright: run migrate before dev server, set SESSION_SECRET
- Unit tests (UserRepository, AuthService, session), integration
  auth-flow, e2e auth.spec (register/login/logout/protected/401)

middleware.ts

@@ -0,0 +1,25 @@
+import { NextResponse, type NextRequest } from 'next/server';
+import { SESSION_COOKIE } from '@/lib/auth/constants';
+
+/**
+ * 認証ミドルウェア（Edge Runtime）。
+ * セッションCookieの「存在」のみを確認し、未所持なら保護画面を /login へリダイレクトする。
+ * HMAC検証・DB参照はNode.js RuntimeのgetCurrentUserで行う（ここでは行わない）。
+ * APIルートは各Route Handlerで401を返すため、本ミドルウェアの対象外とする。
+ */
+export function middleware(request: NextRequest) {
+  const token = request.cookies.get(SESSION_COOKIE)?.value;
+  if (!token) {
+    const loginUrl = new URL('/login', request.url);
+    loginUrl.searchParams.set('redirect', request.nextUrl.pathname);
+    return NextResponse.redirect(loginUrl);
+  }
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: [
+    // /login, /api, _next 静的 assets, favicon を除外
+    '/((?!login|api|_next/static|_next/image|favicon.ico).*)',
+  ],
+};