test(auth): add unit env tests and E2E sign-up/sign-in flow

Unit tests on @ketopath/auth (added to the Vitest workspace):
- readAuthEnv accepts a valid configuration
- rejects secret < 32 chars and non-URL BETTER_AUTH_URL
- preserves Google credentials when both vars are set

Playwright e2e/auth.spec.ts:
- happy path: sign-up creates a user, redirects home with welcome message,
  sign-out clears session, sign-in with the same credentials restores it
- error path: invalid credentials surface a role="alert" message
- each test uses a unique generated email to avoid DB collisions

home.spec.ts: links instead of buttons (CTAs are now next/link).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/auth/package.json

@@ -11,7 +11,9 @@
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "lint": "eslint src --max-warnings=0"
+    "lint": "eslint src --max-warnings=0",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@ketopath/db": "workspace:*",

packages/auth/src/env.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+
+import { readAuthEnv } from './env.js';
+
+const VALID_SECRET = 'a'.repeat(32);
+
+describe('readAuthEnv', () => {
+  it('accepts a valid configuration', () => {
+    const env = readAuthEnv({
+      BETTER_AUTH_SECRET: VALID_SECRET,
+      BETTER_AUTH_URL: 'http://localhost:3000',
+    } as NodeJS.ProcessEnv);
+
+    expect(env.BETTER_AUTH_SECRET).toBe(VALID_SECRET);
+    expect(env.BETTER_AUTH_URL).toBe('http://localhost:3000');
+    expect(env.GOOGLE_CLIENT_ID).toBeUndefined();
+    expect(env.GOOGLE_CLIENT_SECRET).toBeUndefined();
+  });
+
+  it('rejects a secret shorter than 32 chars', () => {
+    expect(() =>
+      readAuthEnv({
+        BETTER_AUTH_SECRET: 'troppo-corto',
+        BETTER_AUTH_URL: 'http://localhost:3000',
+      } as NodeJS.ProcessEnv),
+    ).toThrow(/almeno 32/);
+  });
+
+  it('rejects a non-URL BETTER_AUTH_URL', () => {
+    expect(() =>
+      readAuthEnv({
+        BETTER_AUTH_SECRET: VALID_SECRET,
+        BETTER_AUTH_URL: 'not-a-url',
+      } as NodeJS.ProcessEnv),
+    ).toThrow();
+  });
+
+  it('preserves Google credentials when provided', () => {
+    const env = readAuthEnv({
+      BETTER_AUTH_SECRET: VALID_SECRET,
+      BETTER_AUTH_URL: 'http://localhost:3000',
+      GOOGLE_CLIENT_ID: 'cid',
+      GOOGLE_CLIENT_SECRET: 'csec',
+    } as NodeJS.ProcessEnv);
+    expect(env.GOOGLE_CLIENT_ID).toBe('cid');
+    expect(env.GOOGLE_CLIENT_SECRET).toBe('csec');
+  });
+});

packages/auth/vitest.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    name: '@ketopath/auth',
+    environment: 'node',
+    include: ['src/**/*.test.ts'],
+  },
+});