feat: wire up cookie auth and complete the password reset flow

Implement the previously scaffolded auth. Login issues a JWT in an
httpOnly cookie, the tRPC context verifies it, and a privateProcedure
guards authenticated queries. Add logout and me procedures, and hydrate
client user state on load.

Build out password reset properly. Store a hashed, single-use token with
a one-hour expiry, email the raw token, and add a completion endpoint
plus a /reset-password page to set a new password. The request endpoint
no longer reveals whether an email is registered.

Harden and tidy up alongside:
- restrict CORS to APP_URL with credentials
- honour BASE_PATH in the router basename and the tRPC URL
- type-check vite.config.ts and format the whole repo via .prettierignore
- portable build:server clean and removal of unused dependencies
- accessibility fixes (zoom, input labels) and assorted cleanups

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: enijar

.env.example

@@ -6,5 +6,5 @@ DATABASE_DIALECT=sqlite3
 DATABASE_URL=sqlite3:database.sqlite
 JWT_SECRET=secret
 EMAIL_FROM=hello@example.com
-EMAIL_SMTP_API_KEY=secret
+EMAIL_SMTP_API_KEY=SG.secret
 BASE_PATH=/

.prettierignore

@@ -0,0 +1,4 @@
+node_modules
+build
+package-lock.json
+.idea

README.md

@@ -25,6 +25,8 @@ npm run build
 pm2 startOrReload ecosystem.config.cjs --time --update-env
 ```
 
+The CI workflow builds on the GitHub runner, rsyncs `build` and `node_modules` to the server, then reloads pm2. Because `node_modules` is copied as-is, the runner and the server must share the same OS and CPU architecture so native modules such as `argon2` stay compatible. If they differ, run `npm rebuild` on the server after syncing, or change the workflow to run `npm ci` on the server instead.
+
 Example NGINX config:
 
 ```nginx configuration