fix: auth login flow, Next.js 16 upgrade, ESM/CJS compatibility

- Upgrade Next.js 15 → 16.1 and rename middleware.ts → proxy.ts
- Fix ESM/CJS compatibility: remove "type": "module" from config/shared packages, switch to commonjs
- Fix Better Auth integration: text IDs for sessions/accounts/verifications, wildcard route @All("**"), proper password hash for admin seed
- Fix auth-client to use window.location.origin instead of hardcoded localhost:4000
- Fix api-client, forgot-password, reset-password to use relative /api/ URLs (via Next.js proxy)
- Fix TimeoutInterceptor DI by using useValue instead of useClass
- Add Playwright E2E login tests for localhost and v2.sase.tr
- Add missing UI components: vin-input, vehicle-card, category-tree

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/auth/auth.controller.ts

@@ -2,10 +2,12 @@ import { All, Controller, Req, Res } from "@nestjs/common";
 import { Request, Response } from "express";
 import { getAuth } from "./auth";
 import { toNodeHandler } from "better-auth/node";
+import { Public } from "../common/decorators/public.decorator";
 
 @Controller("auth")
 export class AuthController {
-  @All("*path")
+  @Public()
+  @All("**")
   async handleAuth(@Req() req: Request, @Res() res: Response) {
     const auth = getAuth();
     const handler = toNodeHandler(auth);

apps/api/src/auth/auth.ts

@@ -56,7 +56,10 @@ export function createAuth(databaseUrl: string, secret: string, baseUrl: string)
         },
       },
     },
-    trustedOrigins: (process.env.CORS_ORIGIN || "http://localhost:3000").split(","),
+    trustedOrigins: [
+      ...(process.env.CORS_ORIGIN || "http://localhost:3000").split(","),
+      "http://localhost:4000",
+    ],
   });
 
   return authInstance;