feat: Phase 1 — Authentik auth, MCP endpoint, persistent memory

End-to-end Phase 1 of shared-memory: a logged-in Authentik user can sign
into the Web UI (/me debug page), and an MCP client with an Authentik-
issued bearer token can call memory.write / memory.list / memory.get /
memory.delete plus project.identify against /api/mcp.

Stack:
- Next.js 15 (App Router) + React 19 + TypeScript, pnpm workspaces
- Drizzle ORM + Postgres 16 + pgvector + pg_trgm
- Auth.js v5 with Authentik provider (Web UI)
- jose + Authentik JWKS for MCP bearer-token validation
- JSON-RPC 2.0 dispatcher implementing the MCP wire protocol over plain
  HTTP POST (hand-rolled to fit Next.js App Router; switches to SSE in a
  later phase if server-initiated events are needed)
- bge-small embeddings sidecar deferred to Phase 2; the schema already
  reserves the vector(384) column + IVFFlat index, FTS via a STORED
  tsvector column, and the visibility enum (private/shared/team) so
  cross-user memory sharing can be added without a future migration

Deployment supports two modes (set in .env, never committed):
- Behind an external reverse proxy (HAProxy / nginx / Cloudflare Tunnel /
  Traefik) — DEFAULT; the app exposes APP_PORT on the host with
  X-Forwarded-* trusted, no in-container TLS
- Built-in TLS via Caddy — opt-in with `docker compose --profile tls up`

Discovery endpoint at /.well-known/oauth-protected-resource (RFC 9728)
points MCP clients at the Authentik authorization server after a 401.

README walks through both Authentik providers (Web UI + MCP resource
server), the audience scope mapping, redirect URIs, and includes a worked
HAProxy config snippet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/auth.ts

@@ -0,0 +1,82 @@
+import NextAuth from "next-auth";
+import Authentik from "next-auth/providers/authentik";
+import { env } from "@/lib/env";
+import { db } from "@/lib/db/client";
+import { users } from "@/lib/db/schema";
+
+/**
+ * NextAuth (Auth.js v5) configuration.
+ *
+ * Authentik is the OIDC issuer. We store the user's OIDC `sub` + `iss` on
+ * first sign-in, upserting a row in `users`. The internal user UUID lives on
+ * the JWT/session so downstream code never has to re-resolve it.
+ */
+export const { auth, handlers, signIn, signOut } = NextAuth({
+  providers: [
+    Authentik({
+      clientId: env().OIDC_CLIENT_ID_WEB,
+      clientSecret: env().OIDC_CLIENT_SECRET_WEB,
+      issuer: env().OIDC_ISSUER,
+    }),
+  ],
+  secret: env().NEXTAUTH_SECRET,
+  session: { strategy: "jwt" },
+  // Sign-in page is the default Auth.js form; can be customized later.
+  pages: { signIn: "/api/auth/signin" },
+  callbacks: {
+    async jwt({ token, account, profile }) {
+      // On first call after sign-in, `account` + `profile` are populated.
+      if (account && profile) {
+        const sub = profile.sub;
+        const iss = (profile.iss as string | undefined) ?? env().OIDC_ISSUER;
+        if (!sub) throw new Error("OIDC profile missing `sub` claim");
+
+        const row = await db
+          .insert(users)
+          .values({
+            oidcSub: sub,
+            oidcIss: iss,
+            email: profile.email ?? null,
+            name: profile.name ?? null,
+            picture: (profile.picture as string | undefined) ?? null,
+          })
+          .onConflictDoUpdate({
+            target: [users.oidcIss, users.oidcSub],
+            set: {
+              email: profile.email ?? null,
+              name: profile.name ?? null,
+              picture: (profile.picture as string | undefined) ?? null,
+              lastSeenAt: new Date(),
+            },
+          })
+          .returning({ id: users.id });
+
+        token.userId = row[0]?.id;
+        token.sub = sub;
+        token.iss = iss;
+      }
+      return token;
+    },
+    async session({ session, token }) {
+      if (token.userId && typeof token.userId === "string") {
+        session.user = { ...session.user, id: token.userId };
+      }
+      return session;
+    },
+  },
+});
+
+// ---------- module augmentation: typed session.user.id ----------
+
+declare module "next-auth" {
+  interface Session {
+    user: {
+      id: string;
+      name?: string | null;
+      email?: string | null;
+      image?: string | null;
+    };
+  }
+}
+
+export type { Session } from "next-auth";