feat: ST-001–ST-005 foundation — scaffolding, Prisma, schema, seed, env

- ST-001: Next.js 16 + React 19 + TypeScript strict + Tailwind + shadcn/ui + all deps
- ST-002: Prisma v7 setup with better-sqlite3 adapter (local) and pg adapter (cloud)
- ST-003: Full schema migration (users, pbis, stories, sprints, tasks, todos, api_tokens)
- ST-004: Seed with 9 PBIs, ~40 stories, demo user (demo/demo1234), lars user
- ST-005: Zod-validated env vars, .env.example, lib/session, lib/auth, lib/api-auth

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

prisma/schema.prisma

@@ -0,0 +1,203 @@
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "sqlite"
+}
+
+enum Role {
+  PRODUCT_OWNER
+  SCRUM_MASTER
+  DEVELOPER
+}
+
+enum StoryStatus {
+  OPEN
+  IN_SPRINT
+  DONE
+}
+
+enum TaskStatus {
+  TO_DO
+  IN_PROGRESS
+  DONE
+}
+
+enum LogType {
+  IMPLEMENTATION_PLAN
+  TEST_RESULT
+  COMMIT
+}
+
+enum TestStatus {
+  PASSED
+  FAILED
+}
+
+enum SprintStatus {
+  ACTIVE
+  COMPLETED
+}
+
+model User {
+  id            String     @id @default(cuid())
+  username      String     @unique
+  password_hash String
+  is_demo       Boolean    @default(false)
+  created_at    DateTime   @default(now())
+  updated_at    DateTime   @updatedAt
+  roles         UserRole[]
+  api_tokens    ApiToken[]
+  products      Product[]
+  todos         Todo[]
+
+  @@map("users")
+}
+
+model UserRole {
+  id      String @id @default(cuid())
+  user    User   @relation(fields: [user_id], references: [id], onDelete: Cascade)
+  user_id String
+  role    Role
+
+  @@unique([user_id, role])
+  @@map("user_roles")
+}
+
+model ApiToken {
+  id         String    @id @default(cuid())
+  user       User      @relation(fields: [user_id], references: [id], onDelete: Cascade)
+  user_id    String
+  token_hash String    @unique
+  label      String?
+  created_at DateTime  @default(now())
+  revoked_at DateTime?
+
+  @@index([token_hash])
+  @@map("api_tokens")
+}
+
+model Product {
+  id                 String   @id @default(cuid())
+  user               User     @relation(fields: [user_id], references: [id], onDelete: Cascade)
+  user_id            String
+  name               String
+  description        String?
+  repo_url           String?
+  definition_of_done String
+  archived           Boolean  @default(false)
+  created_at         DateTime @default(now())
+  updated_at         DateTime @updatedAt
+  pbis               Pbi[]
+  sprints            Sprint[]
+  stories            Story[]
+
+  @@unique([user_id, name])
+  @@index([user_id, archived])
+  @@map("products")
+}
+
+model Pbi {
+  id          String   @id @default(cuid())
+  product     Product  @relation(fields: [product_id], references: [id], onDelete: Cascade)
+  product_id  String
+  title       String
+  description String?
+  priority    Int
+  sort_order  Float
+  created_at  DateTime @default(now())
+  updated_at  DateTime @updatedAt
+  stories     Story[]
+
+  @@index([product_id, priority, sort_order])
+  @@map("pbis")
+}
+
+model Story {
+  id                  String      @id @default(cuid())
+  pbi                 Pbi         @relation(fields: [pbi_id], references: [id], onDelete: Cascade)
+  pbi_id              String
+  product             Product     @relation(fields: [product_id], references: [id])
+  product_id          String
+  sprint              Sprint?     @relation(fields: [sprint_id], references: [id])
+  sprint_id           String?
+  title               String
+  description         String?
+  acceptance_criteria String?
+  priority            Int
+  sort_order          Float
+  status              StoryStatus @default(OPEN)
+  created_at          DateTime    @default(now())
+  updated_at          DateTime    @updatedAt
+  logs                StoryLog[]
+  tasks               Task[]
+
+  @@index([pbi_id, priority, sort_order])
+  @@index([sprint_id, sort_order])
+  @@index([product_id, status])
+  @@map("stories")
+}
+
+model StoryLog {
+  id             String      @id @default(cuid())
+  story          Story       @relation(fields: [story_id], references: [id], onDelete: Cascade)
+  story_id       String
+  type           LogType
+  content        String
+  status         TestStatus?
+  commit_hash    String?
+  commit_message String?
+  created_at     DateTime    @default(now())
+
+  @@index([story_id, created_at])
+  @@map("story_logs")
+}
+
+model Sprint {
+  id           String       @id @default(cuid())
+  product      Product      @relation(fields: [product_id], references: [id], onDelete: Cascade)
+  product_id   String
+  sprint_goal  String
+  status       SprintStatus @default(ACTIVE)
+  created_at   DateTime     @default(now())
+  completed_at DateTime?
+  stories      Story[]
+  tasks        Task[]
+
+  @@index([product_id, status])
+  @@map("sprints")
+}
+
+model Task {
+  id          String     @id @default(cuid())
+  story       Story      @relation(fields: [story_id], references: [id], onDelete: Cascade)
+  story_id    String
+  sprint      Sprint?    @relation(fields: [sprint_id], references: [id])
+  sprint_id   String?
+  title       String
+  description String?
+  priority    Int
+  sort_order  Float
+  status      TaskStatus @default(TO_DO)
+  created_at  DateTime   @default(now())
+  updated_at  DateTime   @updatedAt
+
+  @@index([story_id, priority, sort_order])
+  @@index([sprint_id, status])
+  @@map("tasks")
+}
+
+model Todo {
+  id         String   @id @default(cuid())
+  user       User     @relation(fields: [user_id], references: [id], onDelete: Cascade)
+  user_id    String
+  title      String
+  done       Boolean  @default(false)
+  archived   Boolean  @default(false)
+  created_at DateTime @default(now())
+  updated_at DateTime @updatedAt
+
+  @@index([user_id, done, archived])
+  @@map("todos")
+}