feat: implement magic link authentication

[AlexVOiceover]

Summary

• Add complete magic link authentication flow with JWT token generation and verification
• Create login, verify, and logout API endpoints for passwordless authentication
• Implement session middleware to protect routes and expose user session data
• Add staff table lookup in Airtable to differentiate between staff and student users
• Create protected admin route with session-based access control

Changes

• Auth module (src/lib/server/auth.ts): JWT token generation with 15-minute expiry using AUTH_SECRET
• Login endpoint (src/routes/api/auth/login/+server.ts): Validates email against Staff/Apprentices tables, determines user type
• Verify endpoint (src/routes/api/auth/verify/+server.ts): Verifies JWT, creates 90-day session cookie
• Logout endpoint (src/routes/api/auth/logout/+server.ts): Clears session cookie
• Session middleware (src/hooks.server.ts): Parses session cookie and exposes user data to routes
• Protected routes: Admin page with server-side auth check
• Airtable config: Centralized table/field names in src/lib/airtable/config.ts

Test plan

• Verify login with valid staff email returns success
• Verify login with valid apprentice email returns success
• Verify login with unknown email returns 401
• Verify magic link token creates session cookie
• Verify expired token is rejected
• Verify logout clears session
• Verify admin route redirects unauthenticated users
• Run npm run test to confirm auth.spec.ts passes

Related

Closes AP-14

🤖 Generated with Claude Code