refactor(auth): single digest registry, extracted 2FA and login-log, dep bumps

- password.ts: derive plain and salted digest detection from one DIGEST_SCHEMES
  table instead of parallel hardcoded lists, so adding a family is one row.
- auth.ts: move 2FA challenge verification into twofactor-verification.ts and
  the website login-log insert into website-login-log.ts, slimming the
  NextAuth provider to orchestration only.
- deps: bump @formatjs/icu-messageformat-parser, @tanstack/react-query, jszip,
  lucide-react, motion (patch/minor only). @types/react stay pinned per
  pnpm-workspace.yaml; next-auth is already at the newest available (v5 beta).

package.json

@@ -48,9 +48,9 @@
 		"@dnd-kit/core": "6.3.1",
 		"@dnd-kit/sortable": "10.0.0",
 		"@dnd-kit/utilities": "3.2.2",
-		"@formatjs/icu-messageformat-parser": "3.5.17",
+		"@formatjs/icu-messageformat-parser": "3.5.19",
 		"@hookform/resolvers": "5.9.1",
-		"@tanstack/react-query": "5.103.0",
+		"@tanstack/react-query": "5.103.1",
 		"@tanstack/react-virtual": "3.14.13",
 		"class-variance-authority": "0.7.1",
 		"clsx": "2.1.1",
@@ -62,10 +62,10 @@
 		"isomorphic-dompurify": "^4.2.0",
 		"jpeg-js": "0.4.4",
 		"jsonc-parser": "3.3.1",
-		"jszip": "3.10.1",
-		"lucide-react": "1.46.0",
+		"jszip": "3.10.2",
+		"lucide-react": "1.47.0",
 		"lzma-wasm": "1.0.7",
-		"motion": "13.3.0",
+		"motion": "13.4.0",
 		"music-metadata": "11.15.0",
 		"mysql2": "3.24.4",
 		"next": "16.3.5",