MAI CALL - auth v0.2

# O que mudou
1 Schema: failedAttempts + lockedUntil em User; migration auth_v0_2_lockout aplicada; crypto.ts com hashSecret/verifySecret (Node scrypt nativo, zero deps)
2 packages/api/src/auth.ts — authenticateCredential com lockout de 5 tentativas
3 Seed reescrito: admin hashed admin1234, operadores hashed 1111/2222/3333
4 Porta das traseiras fechada: AUTH_DEV_AUTOLOGIN ignorado quando NODE_ENV=production, em ambas as apps
5 operator-pwa: Credentials provider usa PIN + allowedRoles:['OPERATOR']; cookies fieldops-op.*
6 Picker em 2 estados: lista → teclado PIN (botões grandes, dots de progresso, mensagem de erro sem dar pistas)
7 admin-web: Auth.js completo (auth.config, auth.ts, route handler, middleware, /login page, AUTH_SECRET no env) com cookies fieldops-admin.*
8 scripts/auth-smoke.ts (11/11 ✓); .env.example e README atualizados

packages/db/prisma/migrations/20260530105026_auth_v0_2_lockout/migration.sql

@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "User" ADD COLUMN     "failedAttempts" INTEGER NOT NULL DEFAULT 0,
+ADD COLUMN     "lockedUntil" TIMESTAMP(3);

packages/db/prisma/schema.prisma

@@ -37,12 +37,14 @@ model Tenant {
 }
 
 model User {
-  id           String   @id @default(cuid())
-  tenantId     String
-  email        String
-  passwordHash String?
-  role         UserRole @default(OPERATOR)
-  createdAt    DateTime @default(now())
+  id             String    @id @default(cuid())
+  tenantId       String
+  email          String
+  passwordHash   String?
+  role           UserRole  @default(OPERATOR)
+  createdAt      DateTime  @default(now())
+  failedAttempts Int       @default(0)
+  lockedUntil    DateTime?
 
   tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 

packages/db/prisma/seed.ts

@@ -8,12 +8,19 @@ const here = path.dirname(fileURLToPath(import.meta.url));
 loadEnv({ path: path.resolve(here, '../../../.env') });
 
 const { PrismaClient, UserRole } = await import('@prisma/client');
+const { hashSecret } = await import('../src/crypto.js');
+
 const prisma = new PrismaClient();
 
 const DEMO_TENANT_NAME = 'Demo Factory';
 const DEMO_ADMIN_EMAIL = 'admin@demo.local';
+const DEMO_ADMIN_PASSWORD = 'admin1234';
 
-const OPERATOR_EMAILS = ['op1@demo.local', 'op2@demo.local', 'op3@demo.local'];
+const OPERATORS = [
+  { email: 'op1@demo.local', pin: '1111' },
+  { email: 'op2@demo.local', pin: '2222' },
+  { email: 'op3@demo.local', pin: '3333' },
+];
 
 const WORKSTATIONS = [
   { code: 'CTR04',     name: 'Controlo 04',          area: 'Montagem' },
@@ -38,23 +45,33 @@ async function main() {
       tenantId: tenant.id,
       email: DEMO_ADMIN_EMAIL,
       role: UserRole.ADMIN,
+      passwordHash: await hashSecret(DEMO_ADMIN_PASSWORD),
     },
   });
 
-  await prisma.user.createMany({
-    data: OPERATOR_EMAILS.map((email) => ({
-      tenantId: tenant.id,
-      email,
-      role: UserRole.OPERATOR,
-    })),
-  });
+  for (const op of OPERATORS) {
+    await prisma.user.create({
+      data: {
+        tenantId: tenant.id,
+        email: op.email,
+        role: UserRole.OPERATOR,
+        passwordHash: await hashSecret(op.pin),
+      },
+    });
+  }
 
   await prisma.workstation.createMany({
     data: WORKSTATIONS.map((ws) => ({ tenantId: tenant.id, ...ws })),
   });
 
   console.warn(
-    `Seed complete — tenant=${tenant.id} (${tenant.name}), admin=${DEMO_ADMIN_EMAIL}, operators=${OPERATOR_EMAILS.length}, workstations=${WORKSTATIONS.length}`,
+    `Seed complete — tenant=${tenant.id} (${tenant.name})`,
+  );
+  console.warn(
+    `  admin: ${DEMO_ADMIN_EMAIL} / ${DEMO_ADMIN_PASSWORD}`,
+  );
+  console.warn(
+    `  operadores: ${OPERATORS.map((o) => `${o.email}=${o.pin}`).join(' | ')}`,
   );
 }