feat: email+password auth with db-backed sessions

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

lib/db.ts

@@ -29,7 +29,8 @@ export const db = (g.__qaiDb ??= (() => {
 })());
 
 const now = () => Date.now();
-const one = <T>(sql: string, ...p: unknown[]): T | null => (db.prepare(sql).get(...p) as T) ?? null;
+type Row = string | number | null;
+const one = <T>(sql: string, ...p: Row[]): T | null => (db.prepare(sql).get(...p) as T | undefined) ?? null;
 // node:sqlite binds null/number/string/bigint/Buffer only: pass 0/1, never booleans.
 
 export type SettingsInput = { analyst_base_url: string; analyst_key: string; analyst_model: string;