Scaffold Next.js 16 app + wire NextAuth Credentials to auth core

Minimal but real App Router app that builds (next build exit 0):
- src/lib/auth.ts: NextAuth v5 Credentials provider calling checkLogin()
  (argon2id/bcrypt + md5->argon2id upgrade gated by CONVERT_PASSWORDS), JWT
  session, /api/auth/[...nextauth] route handler.
- src/app: root layout, home (force-dynamic, reads hotel_name via siteSettings),
  /login client form (signIn).
- next.config.ts: pinned turbopack.root, serverExternalPackages for the Prisma
  MariaDB adapter; tsconfig set up for Next.

Routes: / (dynamic), /login, /api/auth. Verified: next build exit 0, 28 tests.
Still needs DB+APP_KEY to run auth end-to-end. i18n/middleware/pages to follow.

package.json

@@ -5,6 +5,9 @@
   "engines": { "node": ">=22" },
   "packageManager": "[email protected]",
   "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
     "prisma:generate": "prisma generate",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
@@ -16,11 +19,17 @@
     "@prisma/client": "^7.8.0",
     "bcryptjs": "^3.0.2",
     "hash-wasm": "^4.12.0",
+    "next": "^16.2.9",
+    "next-auth": "5.0.0-beta.31",
     "otplib": "^12.0.1",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
     "zod": "^3.24.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
     "dotenv": "^16.4.0",
     "prisma": "^7.8.0",
     "tsx": "^4.19.0",