feat(m3): auth & user management with session, tests, and e2e

- Custom error classes (lib/errors.ts) and signed-cookie session
  (lib/auth/session.ts, HMAC-SHA256, httpOnly+sameSite=lax)
- UserRepository + AuthService (bcrypt hashing, role/status checks,
  register/login/logout/getCurrentUser/updateProfile)
- Auth helpers (getCurrentUser), user validator, API error handler
- API routes: register (auto-login), login, logout, me, PATCH users/me,
  GET admin/migrations (admin-only guard)
- middleware.ts redirects unauthenticated page access to /login
- Screens: login (login/register toggle), profile, dashboard skeleton,
  home redirect
- vitest: exclude e2e specs, setupFiles for SESSION_SECRET
- playwright: run migrate before dev server, set SESSION_SECRET
- Unit tests (UserRepository, AuthService, session), integration
  auth-flow, e2e auth.spec (register/login/logout/protected/401)

tests/unit/lib/auth/session.test.ts

@@ -0,0 +1,44 @@
+import { describe, it, expect } from 'vitest';
+import { createSessionToken, verifySessionToken } from '@/lib/auth/session';
+
+describe('session token', () => {
+  it('round-trips a user id through create and verify', () => {
+    const token = createSessionToken(42);
+
+    expect(verifySessionToken(token)).toBe(42);
+  });
+
+  it('returns null for a tampered signature', () => {
+    const token = createSessionToken(42);
+    const [encoded] = token.split('.');
+    const tampered = `${encoded}.aW52YWxpZHNpZ25hdHVyZQ`;
+
+    expect(verifySessionToken(tampered)).toBeNull();
+  });
+
+  it('returns null for a tampered payload', () => {
+    const token = createSessionToken(42);
+    const [, signature] = token.split('.');
+    // payload を別ユーザーIDに書き換えたトークン（署名は元のまま）
+    const forgedPayload = Buffer.from(
+      JSON.stringify({ uid: 99, iat: Date.now() })
+    ).toString('base64url');
+    const forged = `${forgedPayload}.${signature}`;
+
+    expect(verifySessionToken(forged)).toBeNull();
+  });
+
+  it('returns null for a malformed token', () => {
+    expect(verifySessionToken('not-a-valid-token')).toBeNull();
+    expect(verifySessionToken('only.one.too.many')).toBeNull();
+    expect(verifySessionToken('')).toBeNull();
+  });
+
+  it('returns null when the payload uid is not a number', () => {
+    const encoded = Buffer.from(
+      JSON.stringify({ uid: 'not-a-number', iat: Date.now() })
+    ).toString('base64url');
+    // 署名は無意味でも構造は整える
+    expect(verifySessionToken(`${encoded}.${encoded}`)).toBeNull();
+  });
+});

tests/unit/repositories/UserRepository.test.ts

@@ -0,0 +1,127 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { createMigratedTestDb } from '@/tests/helpers/db';
+import type { SqliteDatabase } from '@/lib/db/sqlite';
+import { UserRepository } from '@/repositories/UserRepository';
+
+describe('UserRepository', () => {
+  let db: SqliteDatabase;
+  let repo: UserRepository;
+
+  beforeEach(() => {
+    db = createMigratedTestDb();
+    repo = new UserRepository(db);
+  });
+
+  afterEach(() => {
+    db.close();
+  });
+
+  describe('create', () => {
+    it('creates a user and returns it with an id and active status', () => {
+      const user = repo.create({
+        name: 'Alice',
+        email: 'alice@example.com',
+        passwordHash: 'hashed',
+      });
+
+      expect(user.id).toBeGreaterThan(0);
+      expect(user.name).toBe('Alice');
+      expect(user.email).toBe('alice@example.com');
+      expect(user.passwordHash).toBe('hashed');
+      expect(user.role).toBe('member');
+      expect(user.status).toBe('active');
+      expect(user.createdAt).toBeTruthy();
+    });
+
+    it('rejects a duplicate email (UNIQUE constraint)', () => {
+      repo.create({
+        name: 'Alice',
+        email: 'dup@example.com',
+        passwordHash: 'h',
+      });
+      expect(() =>
+        repo.create({
+          name: 'Bob',
+          email: 'dup@example.com',
+          passwordHash: 'h',
+        })
+      ).toThrow();
+    });
+  });
+
+  describe('findById', () => {
+    it('returns the user when found', () => {
+      const created = repo.create({
+        name: 'Alice',
+        email: 'a@example.com',
+        passwordHash: 'h',
+      });
+
+      const found = repo.findById(created.id);
+
+      expect(found?.id).toBe(created.id);
+      expect(found?.name).toBe('Alice');
+    });
+
+    it('returns null when no user exists for the id', () => {
+      expect(repo.findById(99999)).toBeNull();
+    });
+  });
+
+  describe('findByEmail', () => {
+    it('returns the user matching the email', () => {
+      repo.create({ name: 'Alice', email: 'a@example.com', passwordHash: 'h' });
+
+      const found = repo.findByEmail('a@example.com');
+
+      expect(found?.name).toBe('Alice');
+    });
+
+    it('returns null when no user matches the email', () => {
+      expect(repo.findByEmail('nobody@example.com')).toBeNull();
+    });
+  });
+
+  describe('update', () => {
+    it('updates name, email, avatarUrl, role and status', () => {
+      const created = repo.create({
+        name: 'Alice',
+        email: 'a@example.com',
+        passwordHash: 'h',
+      });
+
+      const updated = repo.update(created.id, {
+        name: 'Alice2',
+        email: 'a2@example.com',
+        avatarUrl: 'https://example.com/avatar.png',
+        role: 'system_admin',
+        status: 'inactive',
+      });
+
+      expect(updated?.name).toBe('Alice2');
+      expect(updated?.email).toBe('a2@example.com');
+      expect(updated?.avatarUrl).toBe('https://example.com/avatar.png');
+      expect(updated?.role).toBe('system_admin');
+      expect(updated?.status).toBe('inactive');
+    });
+
+    it('only updates provided fields', () => {
+      const created = repo.create({
+        name: 'Alice',
+        email: 'a@example.com',
+        passwordHash: 'h',
+      });
+
+      const updated = repo.update(created.id, { name: 'NewName' });
+
+      expect(updated?.name).toBe('NewName');
+      expect(updated?.email).toBe('a@example.com');
+    });
+
+    it('returns null when updating a non-existent user', () => {
+      const result = repo.update(99999, { name: 'X' });
+      // UPDATE affects 0 rows; findById returns null
+      expect(result).toBeNull();
+    });
+  });
+});

tests/unit/services/AuthService.test.ts

@@ -0,0 +1,177 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { createMigratedTestDb } from '@/tests/helpers/db';
+import type { SqliteDatabase } from '@/lib/db/sqlite';
+import { UserRepository } from '@/repositories/UserRepository';
+import { AuthService } from '@/services/AuthService';
+import { ConflictError, UnauthorizedError, NotFoundError } from '@/lib/errors';
+import { verifySessionToken } from '@/lib/auth/session';
+import bcrypt from 'bcrypt';
+
+describe('AuthService', () => {
+  let db: SqliteDatabase;
+  let repo: UserRepository;
+  let authService: AuthService;
+
+  beforeEach(() => {
+    db = createMigratedTestDb();
+    repo = new UserRepository(db);
+    authService = new AuthService(repo);
+  });
+
+  afterEach(() => {
+    db.close();
+  });
+
+  describe('register', () => {
+    it('creates a user with a bcrypt-hashed password', () => {
+      const user = authService.register({
+        name: 'Alice',
+        email: 'alice@example.com',
+        password: 'password123',
+      });
+
+      expect(user.id).toBeGreaterThan(0);
+      expect(user.passwordHash).not.toBe('password123');
+      expect(bcrypt.compareSync('password123', user.passwordHash!)).toBe(true);
+      expect(user.role).toBe('member');
+      expect(user.status).toBe('active');
+    });
+
+    it('throws ConflictError when the email is already registered', () => {
+      authService.register({
+        name: 'Alice',
+        email: 'dup@example.com',
+        password: 'password123',
+      });
+
+      expect(() =>
+        authService.register({
+          name: 'Bob',
+          email: 'dup@example.com',
+          password: 'password123',
+        })
+      ).toThrow(ConflictError);
+    });
+
+    it('throws ValidationError for a weak password', () => {
+      expect(() =>
+        authService.register({
+          name: 'Alice',
+          email: 'a@example.com',
+          password: 'short',
+        })
+      ).toThrow();
+    });
+  });
+
+  describe('login', () => {
+    beforeEach(() => {
+      authService.register({
+        name: 'Alice',
+        email: 'alice@example.com',
+        password: 'password123',
+      });
+    });
+
+    it('returns the user and a verifiable session token on success', () => {
+      const { user, token } = authService.login(
+        'alice@example.com',
+        'password123'
+      );
+
+      expect(user.email).toBe('alice@example.com');
+      expect(verifySessionToken(token)).toBe(user.id);
+    });
+
+    it('throws UnauthorizedError when the password is wrong', () => {
+      expect(() =>
+        authService.login('alice@example.com', 'wrong-password')
+      ).toThrow(UnauthorizedError);
+    });
+
+    it('throws UnauthorizedError when the email does not exist', () => {
+      expect(() =>
+        authService.login('nobody@example.com', 'password123')
+      ).toThrow(UnauthorizedError);
+    });
+
+    it('throws UnauthorizedError when the account is inactive', () => {
+      const user = repo.findByEmail('alice@example.com')!;
+      repo.update(user.id, { status: 'inactive' });
+
+      expect(() =>
+        authService.login('alice@example.com', 'password123')
+      ).toThrow(UnauthorizedError);
+    });
+  });
+
+  describe('getCurrentUser', () => {
+    it('returns the user for a valid id', () => {
+      const created = authService.register({
+        name: 'Alice',
+        email: 'alice@example.com',
+        password: 'password123',
+      });
+
+      expect(authService.getCurrentUser(created.id)?.email).toBe(
+        'alice@example.com'
+      );
+    });
+
+    it('returns null for an unknown id', () => {
+      expect(authService.getCurrentUser(99999)).toBeNull();
+    });
+  });
+
+  describe('updateProfile', () => {
+    it('updates name and email', () => {
+      const created = authService.register({
+        name: 'Alice',
+        email: 'alice@example.com',
+        password: 'password123',
+      });
+
+      const updated = authService.updateProfile(created.id, {
+        name: 'Alice New',
+        email: 'alice2@example.com',
+      });
+
+      expect(updated.name).toBe('Alice New');
+      expect(updated.email).toBe('alice2@example.com');
+    });
+
+    it('throws ConflictError when changing email to one already in use', () => {
+      authService.register({
+        name: 'Alice',
+        email: 'alice@example.com',
+        password: 'password123',
+      });
+      const bob = authService.register({
+        name: 'Bob',
+        email: 'bob@example.com',
+        password: 'password123',
+      });
+
+      expect(() =>
+        authService.updateProfile(bob.id, { email: 'alice@example.com' })
+      ).toThrow(ConflictError);
+    });
+
+    it('throws NotFoundError when the user does not exist', () => {
+      expect(() => authService.updateProfile(99999, { name: 'X' })).toThrow(
+        NotFoundError
+      );
+    });
+  });
+
+  describe('createWithRole', () => {
+    it('creates a user with the specified role', () => {
+      const admin = authService.createWithRole(
+        { name: 'Admin', email: 'admin@example.com', password: 'password123' },
+        'system_admin'
+      );
+
+      expect(admin.role).toBe('system_admin');
+    });
+  });
+});