chore: initial Vector 2.0 monorepo

Ground-up TypeScript rewrite of the Vector hardware parts inventory
system. Ships the full roadmap (Phases 0-8) in one initial commit:

- pnpm + Turbo monorepo: apps/{api,web,e2e}, packages/{db,shared,ui,config}
- Express 5 + Prisma 5 + zod validation + JWT w/ refresh-token rotation
- React 19 + Vite + shadcn/ui + TanStack Query/Table + nuqs URL state
- Repair/RMA, tags, bulk ops, saved views, CSV audit export
- Analytics dashboard on Recharts + EOL tracking
- Signed webhook subscriptions (HMAC-SHA256) with in-process emitter
- Vitest unit tests (shared schemas, api services/helpers) + Playwright skeleton
- Gitea Actions CI (lint, typecheck, test+coverage, build) + Renovate

Deferred follow-ups: Postgres cutover (data-migration script ready),
BullMQ worker for webhook delivery, @react-pdf PDF export, CSV import wizard.

packages/shared/src/auth.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest';
+import { LoginRequest, UserPublic } from './auth.js';
+
+describe('LoginRequest', () => {
+  it('accepts valid credentials', () => {
+    expect(LoginRequest.safeParse({ username: 'u', password: 'p' }).success).toBe(true);
+  });
+
+  it('rejects empty username or password', () => {
+    expect(LoginRequest.safeParse({ username: '', password: 'p' }).success).toBe(false);
+    expect(LoginRequest.safeParse({ username: 'u', password: '' }).success).toBe(false);
+  });
+
+  it('caps username at 64 and password at 256', () => {
+    expect(
+      LoginRequest.safeParse({ username: 'a'.repeat(65), password: 'p' }).success,
+    ).toBe(false);
+    expect(
+      LoginRequest.safeParse({ username: 'u', password: 'a'.repeat(257) }).success,
+    ).toBe(false);
+  });
+});
+
+describe('UserPublic', () => {
+  it('accepts an ISO string createdAt', () => {
+    const r = UserPublic.safeParse({
+      id: '11111111-1111-4111-8111-111111111111',
+      username: 'u',
+      email: 'u@x.dev',
+      role: 'ADMIN',
+      createdAt: new Date().toISOString(),
+    });
+    expect(r.success).toBe(true);
+  });
+
+  it('rejects invalid role', () => {
+    expect(
+      UserPublic.safeParse({
+        id: '11111111-1111-4111-8111-111111111111',
+        username: 'u',
+        email: 'u@x.dev',
+        role: 'SUPER_ADMIN',
+        createdAt: new Date().toISOString(),
+      }).success,
+    ).toBe(false);
+  });
+});