MAI CALL - auth v0.2

# O que mudou
1 Schema: failedAttempts + lockedUntil em User; migration auth_v0_2_lockout aplicada; crypto.ts com hashSecret/verifySecret (Node scrypt nativo, zero deps)
2 packages/api/src/auth.ts — authenticateCredential com lockout de 5 tentativas
3 Seed reescrito: admin hashed admin1234, operadores hashed 1111/2222/3333
4 Porta das traseiras fechada: AUTH_DEV_AUTOLOGIN ignorado quando NODE_ENV=production, em ambas as apps
5 operator-pwa: Credentials provider usa PIN + allowedRoles:['OPERATOR']; cookies fieldops-op.*
6 Picker em 2 estados: lista → teclado PIN (botões grandes, dots de progresso, mensagem de erro sem dar pistas)
7 admin-web: Auth.js completo (auth.config, auth.ts, route handler, middleware, /login page, AUTH_SECRET no env) com cookies fieldops-admin.*
8 scripts/auth-smoke.ts (11/11 ✓); .env.example e README atualizados

apps/operator-pwa/lib/auth.config.ts

@@ -10,7 +10,14 @@ export const authConfig = {
   trustHost: true,
   session: { strategy: 'jwt' },
   pages: {
-    // No login UI in this scaffold phase. See auth.ts for the placeholder.
+    signIn: '/select-operator',
+  },
+  // Distinct cookie names prevent session collision when both apps run on localhost
+  // (cookies are not isolated by port — only by name and domain).
+  cookies: {
+    sessionToken: { name: 'fieldops-op.session-token' },
+    callbackUrl:  { name: 'fieldops-op.callback-url' },
+    csrfToken:    { name: 'fieldops-op.csrf-token' },
   },
   callbacks: {
     async jwt({ token, user }) {

apps/operator-pwa/lib/auth.ts

@@ -1,7 +1,8 @@
 import NextAuth from 'next-auth';
 import Credentials from 'next-auth/providers/credentials';
 import { prisma } from '@repo/db';
-import type { SessionUser } from '@repo/api';
+import { authenticateCredential } from '@repo/api';
+import type { SessionUser } from '@repo/api';  // eslint-disable-line @typescript-eslint/no-unused-vars
 import { env } from '../env';
 import { authConfig } from './auth.config';
 
@@ -36,24 +37,29 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
   secret: env.AUTH_SECRET,
   providers: [
     Credentials({
-      name: 'Email (placeholder)',
+      name: 'Operador (PIN)',
       credentials: {
-        email: { label: 'Email', type: 'email' },
+        email: { label: 'Email', type: 'text' },
+        pin: { label: 'PIN', type: 'password' },
       },
       async authorize(credentials) {
         const email = credentials?.email;
-        if (typeof email !== 'string' || !email) return null;
-        const user = await prisma.user.findFirst({ where: { email } });
-        if (!user) return null;
-        // NO password verification — placeholder only.
+        const pin = credentials?.pin;
+        if (typeof email !== 'string' || typeof pin !== 'string') return null;
+        const u = await authenticateCredential({
+          email,
+          secret: pin,
+          allowedRoles: ['OPERATOR'],
+        });
+        if (!u) return null;
         return {
-          id: user.id,
-          email: user.email,
-          name: user.email,
+          id: u.id,
+          email: u.email,
+          name: u.email,
           // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          role: user.role as any,
+          role: u.role as any,
           // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          tenantId: user.tenantId as any,
+          tenantId: u.tenantId as any,
         };
       },
     }),
@@ -74,9 +80,9 @@ export async function resolveUser(): Promise<SessionUser | null> {
     return { id: u.id, email: u.email, role: u.role, tenantId: u.tenantId };
   }
 
-  if (env.AUTH_DEV_AUTOLOGIN) {
-    // Dev back door. Production guards: env flag default is false; this branch
-    // is also a no-op if the seed user doesn't exist.
+  const autologinAllowed = env.AUTH_DEV_AUTOLOGIN && process.env.NODE_ENV !== 'production';
+  if (autologinAllowed) {
+    // Dev back door. Disabled in production even if the env flag is set.
     const admin = await prisma.user.findFirst({ where: { email: 'admin@demo.local' } });
     if (admin) {
       return {