feat: email+password auth with db-backed sessions

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/auth.test.ts

@@ -0,0 +1,20 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+process.env.DATA_DIR = mkdtempSync(`${tmpdir()}/qai-auth-`);
+const { hashPassword, verifyPassword, hashToken } = await import("../lib/auth.ts");
+
+test("password hash round-trips and rejects", () => {
+  const h = hashPassword("correct horse battery staple");
+  assert.ok(h.includes(":"), "salt:hash shape");
+  assert.ok(verifyPassword("correct horse battery staple", h));
+  assert.ok(!verifyPassword("wrong", h));
+});
+test("malformed stored hash never verifies", () => {
+  for (const bad of ["", "nosep", "a:", ":b", "zz:zz"]) assert.ok(!verifyPassword("x", bad));
+});
+test("token hash is stable, 64 hex", () => {
+  assert.equal(hashToken("abc"), hashToken("abc"));
+  assert.match(hashToken("abc"), /^[0-9a-f]{64}$/);
+});