fix: auth login flow, Next.js 16 upgrade, ESM/CJS compatibility

- Upgrade Next.js 15 → 16.1 and rename middleware.ts → proxy.ts
- Fix ESM/CJS compatibility: remove "type": "module" from config/shared packages, switch to commonjs
- Fix Better Auth integration: text IDs for sessions/accounts/verifications, wildcard route @All("**"), proper password hash for admin seed
- Fix auth-client to use window.location.origin instead of hardcoded localhost:4000
- Fix api-client, forgot-password, reset-password to use relative /api/ URLs (via Next.js proxy)
- Fix TimeoutInterceptor DI by using useValue instead of useClass
- Add Playwright E2E login tests for localhost and v2.sase.tr
- Add missing UI components: vin-input, vehicle-card, category-tree

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/database/schema/core.ts

@@ -36,7 +36,7 @@ export const users = pgTable(
 export const sessions = pgTable(
   "sessions",
   {
-    id: uuid("id").primaryKey().defaultRandom(),
+    id: text("id").primaryKey(),
     userId: uuid("user_id")
       .notNull()
       .references(() => users.id, { onDelete: "cascade" }),
@@ -54,7 +54,7 @@ export const sessions = pgTable(
 export const accounts = pgTable(
   "accounts",
   {
-    id: uuid("id").primaryKey().defaultRandom(),
+    id: text("id").primaryKey(),
     userId: uuid("user_id")
       .notNull()
       .references(() => users.id, { onDelete: "cascade" }),
@@ -77,7 +77,7 @@ export const accounts = pgTable(
 export const verifications = pgTable(
   "verifications",
   {
-    id: uuid("id").primaryKey().defaultRandom(),
+    id: text("id").primaryKey(),
     identifier: text("identifier").notNull(),
     value: text("value").notNull(),
     expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),

apps/api/src/database/seed.ts

@@ -74,8 +74,7 @@ async function seed() {
     .returning();
 
   if (adminUser) {
-    // Create credential account for admin (password: Admin123!)
-    // In production, use Better Auth's proper password hashing
+    // Password: Sase2026 (hashed with Better Auth's hashPassword)
     await db
       .insert(accounts)
       .values({
@@ -83,7 +82,7 @@ async function seed() {
         accountId: adminUser.id,
         providerId: "credential",
         password:
-          "$2a$10$placeholder_hash_replace_with_better_auth",
+          "5a51a76d4092d38c578b0b728aecac18:bb7877ca1148573e0980c7a825a10cda592fd01a13e7262811a8cee3d6174632ebe5392539b31d5c1f0de69620961d447cb9f929414cb1ec30ff66037a9c38f5",
       })
       .onConflictDoNothing();
   }
@@ -91,7 +90,7 @@ async function seed() {
   console.log("Seed completed!");
   console.log(`- ${BRANDS_DATA.length} brands`);
   console.log(`- ${PLANS_DATA.length} plans`);
-  console.log("- 1 admin user (admin@sase.tr)");
+  console.log("- 1 admin user (admin@sase.tr / Sase2026)");
 
   await client.end();
   process.exit(0);