feat(m3): auth & user management with session, tests, and e2e

- Custom error classes (lib/errors.ts) and signed-cookie session
  (lib/auth/session.ts, HMAC-SHA256, httpOnly+sameSite=lax)
- UserRepository + AuthService (bcrypt hashing, role/status checks,
  register/login/logout/getCurrentUser/updateProfile)
- Auth helpers (getCurrentUser), user validator, API error handler
- API routes: register (auto-login), login, logout, me, PATCH users/me,
  GET admin/migrations (admin-only guard)
- middleware.ts redirects unauthenticated page access to /login
- Screens: login (login/register toggle), profile, dashboard skeleton,
  home redirect
- vitest: exclude e2e specs, setupFiles for SESSION_SECRET
- playwright: run migrate before dev server, set SESSION_SECRET
- Unit tests (UserRepository, AuthService, session), integration
  auth-flow, e2e auth.spec (register/login/logout/protected/401)

tests/unit/lib/auth/session.test.ts

@@ -0,0 +1,44 @@
+import { describe, it, expect } from 'vitest';
+import { createSessionToken, verifySessionToken } from '@/lib/auth/session';
+
+describe('session token', () => {
+  it('round-trips a user id through create and verify', () => {
+    const token = createSessionToken(42);
+
+    expect(verifySessionToken(token)).toBe(42);
+  });
+
+  it('returns null for a tampered signature', () => {
+    const token = createSessionToken(42);
+    const [encoded] = token.split('.');
+    const tampered = `${encoded}.aW52YWxpZHNpZ25hdHVyZQ`;
+
+    expect(verifySessionToken(tampered)).toBeNull();
+  });
+
+  it('returns null for a tampered payload', () => {
+    const token = createSessionToken(42);
+    const [, signature] = token.split('.');
+    // payload を別ユーザーIDに書き換えたトークン（署名は元のまま）
+    const forgedPayload = Buffer.from(
+      JSON.stringify({ uid: 99, iat: Date.now() })
+    ).toString('base64url');
+    const forged = `${forgedPayload}.${signature}`;
+
+    expect(verifySessionToken(forged)).toBeNull();
+  });
+
+  it('returns null for a malformed token', () => {
+    expect(verifySessionToken('not-a-valid-token')).toBeNull();
+    expect(verifySessionToken('only.one.too.many')).toBeNull();
+    expect(verifySessionToken('')).toBeNull();
+  });
+
+  it('returns null when the payload uid is not a number', () => {
+    const encoded = Buffer.from(
+      JSON.stringify({ uid: 'not-a-number', iat: Date.now() })
+    ).toString('base64url');
+    // 署名は無意味でも構造は整える
+    expect(verifySessionToken(`${encoded}.${encoded}`)).toBeNull();
+  });
+});