Secure Login V2

[SynthicProgram]

Auth: GitHub OAuth + password signup, hardened sessions

The old login compared passwords in plaintext and had dead Google/Apple buttons.
This replaces it with real auth: local email/password signup and GitHub OAuth,
both ending in the same server side session.

Server

GitHub OAuth at /auth/github, using passport-github2.

• Links to an existing local account when the email matches.
• Derives a free username when the GitHub login is already taken.
• Rejects an email already owned by a different GitHub account.

Sessions via express-session + passport.

• Cookie is httpOnly, sameSite=lax, secure in production.
• Session id regenerates on every login, which closes session fixation.
• Only the user id is serialized, so password_hash never reaches the store.

Passwords via bcrypt.

• Hashed on signup, compared with bcrypt.compare on login.
• Failures return one generic error, so the endpoint does not leak which emails
  are registered.
• Signup validates email, username and password shape on the server, and returns
  a clean 409 on duplicates.

Other

• CORS added, credentialed, restricted to CLIENT_URL.
• Origins centralized in config/urls.js.
• Final Express error handler added. A throw used to render a raw stack to the
  browser.
• PGSSL=false escape hatch for a local Postgres that does not speak SSL.

Client

• New /signup page with validation matching the server.
• Login page has a GitHub button in place of the non functional OAuth buttons,
  and shows a readable message for ?error= codes from the callback.
• Home revalidates the server session instead of trusting localStorage. The
  old check rendered the page as signed in when no live session existed.

Schema (breaking, requires a DB reset)

• users.password_hash is now nullable.
• users.github_id VARCHAR(255) UNIQUE added.
• users_has_credential CHECK enforces at least one of the two.
• Seed data holds plaintext demo passwords that resetDatabase.js hashes on insert.

Before running

1. Copy Code/server/.env.example to .env.
2. Generate SESSION_SECRET. The server refuses to start without it.
3. Add GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET. The callback URL registered
   on the GitHub app must be exactly ${SERVER_URL}/auth/github/callback.
4. Re run resetDatabase.js.

Note for reviewers

createUser and the OAuth verify callback both check then insert, so they lean on
the unique constraint as the real guarantee under concurrency. Both catch 23505 and
turn it into a clean 409 or account_conflict. Worth a second pair of eyes.