feat(auth): add NextAuth.js with credentials provider

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/web/middleware.ts

@@ -0,0 +1,27 @@
+import { withAuth } from 'next-auth/middleware';
+import { NextResponse } from 'next/server';
+
+export default withAuth(
+  function middleware(req) {
+    const token = req.nextauth.token;
+    const pathname = req.nextUrl.pathname;
+
+    // Check for SUPER_ADMIN only routes
+    if (pathname.startsWith('/admin/settings')) {
+      if (token?.role !== 'SUPER_ADMIN') {
+        return NextResponse.redirect(new URL('/admin', req.url));
+      }
+    }
+
+    return NextResponse.next();
+  },
+  {
+    callbacks: {
+      authorized: ({ token }) => !!token,
+    },
+  }
+);
+
+export const config = {
+  matcher: ['/admin/:path*'],
+};