feat: email+password auth with db-backed sessions

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

lib/actions.ts

@@ -0,0 +1,34 @@
+"use server";
+import { redirect } from "next/navigation";
+import { revalidatePath } from "next/cache";
+import { userByEmail, getSettings, renameAnalysis, deleteAnalysis } from "@/lib/db";
+import { signUpNewUser, verifyPassword, startSession, endSession, requireUser, emailOk } from "@/lib/auth";
+
+export async function signUp(_: unknown, fd: FormData) {
+  const r = signUpNewUser(String(fd.get("email") ?? ""), String(fd.get("password") ?? ""));
+  if (!r.ok) return r;
+  await startSession(r.id);
+  redirect("/setup");
+}
+export async function signIn(_: unknown, fd: FormData) {
+  const e = String(fd.get("email") ?? "").trim().toLowerCase();
+  const u = emailOk(e) ? userByEmail(e) : null;
+  if (!u || !verifyPassword(String(fd.get("password") ?? ""), u.pass))
+    return { ok: false, error: "Email or password is wrong." };
+  await startSession(u.id);
+  redirect(getSettings(u.id)?.onboarded === 1 ? "/app" : "/setup");
+}
+export async function signOut() { await endSession(); redirect("/login"); }
+
+export async function rename(_: unknown, fd: FormData) {
+  const u = await requireUser();
+  const id = String(fd.get("id") ?? "");
+  const title = String(fd.get("title") ?? "").trim().slice(0, 120);
+  if (id && title) renameAnalysis(id, u.id, title);
+  revalidatePath("/app");
+}
+export async function remove(_: unknown, fd: FormData) {
+  const u = await requireUser();
+  deleteAnalysis(String(fd.get("id") ?? ""), u.id);
+  revalidatePath("/app");
+}