Scaffold Next.js 16 app + wire NextAuth Credentials to auth core

Minimal but real App Router app that builds (next build exit 0):
- src/lib/auth.ts: NextAuth v5 Credentials provider calling checkLogin()
  (argon2id/bcrypt + md5->argon2id upgrade gated by CONVERT_PASSWORDS), JWT
  session, /api/auth/[...nextauth] route handler.
- src/app: root layout, home (force-dynamic, reads hotel_name via siteSettings),
  /login client form (signIn).
- next.config.ts: pinned turbopack.root, serverExternalPackages for the Prisma
  MariaDB adapter; tsconfig set up for Next.

Routes: / (dynamic), /login, /api/auth. Verified: next build exit 0, 28 tests.
Still needs DB+APP_KEY to run auth end-to-end. i18n/middleware/pages to follow.

src/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,3 @@
+import { handlers } from "@/lib/auth";
+
+export const { GET, POST } = handlers;

src/app/layout.tsx

@@ -0,0 +1,15 @@
+import type { Metadata } from "next";
+import type { ReactNode } from "react";
+
+export const metadata: Metadata = {
+  title: "AtomCMS",
+  description: "AtomCMS — retro hotel CMS (Next.js conversion)",
+};
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}

src/app/login/page.tsx

@@ -0,0 +1,49 @@
+"use client";
+
+import { signIn } from "next-auth/react";
+import { type FormEvent, useState } from "react";
+
+export default function LoginPage() {
+  const [username, setUsername] = useState("");
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState(false);
+
+  async function onSubmit(e: FormEvent) {
+    e.preventDefault();
+    setError(null);
+    setPending(true);
+    const res = await signIn("credentials", { username, password, redirect: false });
+    setPending(false);
+    if (!res || res.error) {
+      setError("Invalid username or password");
+      return;
+    }
+    window.location.href = "/";
+  }
+
+  return (
+    <main style={{ fontFamily: "system-ui", padding: "2rem", maxWidth: 360 }}>
+      <h1>Login</h1>
+      <form onSubmit={onSubmit} style={{ display: "grid", gap: "0.5rem" }}>
+        <input
+          value={username}
+          onChange={(e) => setUsername(e.target.value)}
+          placeholder="Username"
+          autoComplete="username"
+        />
+        <input
+          type="password"
+          value={password}
+          onChange={(e) => setPassword(e.target.value)}
+          placeholder="Password"
+          autoComplete="current-password"
+        />
+        <button type="submit" disabled={pending}>
+          {pending ? "Signing in…" : "Sign in"}
+        </button>
+      </form>
+      {error && <p style={{ color: "crimson" }}>{error}</p>}
+    </main>
+  );
+}

src/app/page.tsx

@@ -0,0 +1,17 @@
+import Link from "next/link";
+import { siteSettings } from "@/lib/services/site-settings";
+
+// Reads settings from the DB at request time — never at build.
+export const dynamic = "force-dynamic";
+
+export default async function HomePage() {
+  const hotelName = (await siteSettings.get("hotel_name", "Atom")) ?? "Atom";
+
+  return (
+    <main style={{ fontFamily: "system-ui", padding: "2rem", maxWidth: 640 }}>
+      <h1>Welcome to {hotelName}</h1>
+      <p>AtomCMS → Next.js conversion. Foundation, full Prisma schema and auth core are in place.</p>
+      <Link href="/login">Login →</Link>
+    </main>
+  );
+}