Run 01-01: Effect 4 setup + D1 schema + Db/Session services

Projekt nemel auth deps ani D1. Pridany effect@4.0.0-beta.67, drizzle-orm, drizzle-kit; vytvorena D1 databaze oskar-db s bindingem DB v wrangler.jsonc; pridany scripty db:generate, db:migrate:local/remote.

Auth potreboval persistent storage. Drizzle schema definuje 4 tabulky (users, sessions, oauth_accounts s composite PK, password_resets) vcetne FK cascade a indexu. Tabulky pro Sprint 002 jsou pridane preventivne aby nebyla druha migrace. Migrace aplikovana lokalne.

Auth flow potreboval typove vsechny failure mody. AuthError ADT v errors.ts pres Data.TaggedError pokryva 9 tagu (UserAlreadyExists, UserNotFound, InvalidCredentials, SessionNotFound/Expired, DbError, ValidationError, ConfigMissing, TokenInvalid). Runtime adapter pres ne exhaustive switchuje na HTTP statusy.

Effect services potrebovaly D1 abstrakci. Db service (Context.Service v Effect 4) drzi drizzle handle + raw D1Database a expose run(operation, fn) helper co maps Promise na Effect s DbError. D1Binding je separatni service co se providuje z env.DB v runtime adapteru.

Login flow potrebuje session management. Session service (zavislost na Db) expose create/findByCookie/revoke/revokeAllForUser. Session ID = 32B random bytes base64url, default TTL 30 dni, findByCookie kontroluje expiry + maze expired session + touchuje lastUsedAt. K tomu cookie helpers (serialize/clear/parse) pro Run 01-03.

Astro endpointy potrebovaly entrypoint do Effect. Runtime.ts ma module-level ManagedRuntime (cached per Worker isolate) co builds Layer z DbLive + SessionLive + provideD1(env.DB) z cloudflare:workers. Export runAuth() a runAuthToResponse() (druha mapuje AuthError tagy na 400/401/409/500 Response).

Astro middleware potrebuje typed locals. env.d.ts deklaruje App.Locals.user a App.Locals.session jako nullable. Smoke endpoint /api/smoke overuje runtime+D1 connect (vraci pocet useru), v dev serveru vratil {ok:true,users:0}, pred commitem smazan.