feat(app): Next.js 16 + Auth.js v5 portal skeleton

Next.js 16 + Auth.js v5 skeleton: host→slug middleware, tenant-context layout, OIDC sign-in flow against breakpilot-dev realm. 100% coverage on src/lib. Bumps next to 16.2.6 to clear trivy CVEs in 15.0.3.

.gitea/workflows/ci.yaml

@@ -57,7 +57,7 @@ jobs:
 
   test:
     runs-on: docker
-    if: hashFiles('package.json') != ''
+
     steps:
       - uses: actions/checkout@v4
 
@@ -72,11 +72,17 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm lint
       - run: pnpm typecheck
-      - run: pnpm test --coverage
+      # `pnpm test` already includes --coverage via the package.json script.
+      - run: pnpm test
       - name: coverage gate
         run: |
           node -e "const c=require('./coverage/coverage-summary.json').total.lines.pct; if (c<70) { console.error('coverage', c, '< 70%'); process.exit(1) }"
-      - run: pnpm build
+      - name: build
+        env:
+          # Required at build-time by Auth.js. Replaced by Infisical-sourced
+          # secret in stage/prod via Orca env injection (M5.1+).
+          AUTH_SECRET: ci-build-dummy-${{ github.sha }}
+        run: pnpm build
 
   e2e:
     needs: test