feat(01-02): configure NextAuth.js v4 with credentials provider and JWT

- Install next-auth@4, bcryptjs, @types/bcryptjs, @types/jest
- src/types/next-auth.d.ts: extend Session/JWT with tenantId, roles, isSuperAdmin
- src/lib/auth-options.ts: CredentialsProvider + JWT/session callbacks, 24h maxAge
- src/lib/auth.ts: getServerSession() and getCurrentUser() server helpers
- src/app/api/auth/[...nextauth]/route.ts: NextAuth GET/POST handler
- src/middleware.ts: withAuth middleware protecting all routes except /login /signup /api/auth/*

src/middleware.ts

@@ -0,0 +1,36 @@
+import { withAuth } from "next-auth/middleware";
+import { NextResponse } from "next/server";
+
+export default withAuth(
+  function middleware(req) {
+    // If user is authenticated, allow request through
+    return NextResponse.next();
+  },
+  {
+    callbacks: {
+      authorized({ token }) {
+        // Return true if token exists (user is authenticated)
+        return !!token;
+      },
+    },
+    pages: {
+      signIn: "/login",
+    },
+  }
+);
+
+// Apply middleware to all routes EXCEPT public ones
+export const config = {
+  matcher: [
+    /*
+     * Match all request paths EXCEPT:
+     * - /login (sign-in page)
+     * - /signup (registration page)
+     * - /api/auth/* (NextAuth endpoints)
+     * - /_next/* (Next.js internals)
+     * - /favicon.ico, /robots.txt, /sitemap.xml (static files)
+     * - Image files (.png, .jpg, .jpeg, .gif, .webp, .svg, .ico)
+     */
+    "/((?!login|signup|api/auth|_next/static|_next/image|favicon\\.ico|robots\\.txt|sitemap\\.xml|.*\\.(?:png|jpg|jpeg|gif|webp|svg|ico)).*)",
+  ],
+};