Scaffold Next.js 16 app + wire NextAuth Credentials to auth core

Minimal but real App Router app that builds (next build exit 0):
- src/lib/auth.ts: NextAuth v5 Credentials provider calling checkLogin()
  (argon2id/bcrypt + md5->argon2id upgrade gated by CONVERT_PASSWORDS), JWT
  session, /api/auth/[...nextauth] route handler.
- src/app: root layout, home (force-dynamic, reads hotel_name via siteSettings),
  /login client form (signIn).
- next.config.ts: pinned turbopack.root, serverExternalPackages for the Prisma
  MariaDB adapter; tsconfig set up for Next.

Routes: / (dynamic), /login, /api/auth. Verified: next build exit 0, 28 tests.
Still needs DB+APP_KEY to run auth end-to-end. i18n/middleware/pages to follow.

src/env.ts

@@ -9,6 +9,13 @@ const schema = z.object({
   DATABASE_POOL_SIZE: z.coerce.number().int().positive().default(40),
   DATABASE_IDLE_TIMEOUT_MS: z.coerce.number().int().positive().default(300_000),
   HOTEL_NAME: z.string().default("Atom"),
+  // NextAuth v5 reads AUTH_SECRET itself; declared here for documentation/typing.
+  AUTH_SECRET: z.string().min(1).optional(),
+  // Mirrors Laravel config('habbo.site.convert_passwords') — enables md5->argon2id.
+  CONVERT_PASSWORDS: z
+    .string()
+    .optional()
+    .transform((v) => v === "true" || v === "1"),
 });
 
 type Env = z.infer<typeof schema>;