MAI CALL - auth v0.2

# O que mudou
1 Schema: failedAttempts + lockedUntil em User; migration auth_v0_2_lockout aplicada; crypto.ts com hashSecret/verifySecret (Node scrypt nativo, zero deps)
2 packages/api/src/auth.ts — authenticateCredential com lockout de 5 tentativas
3 Seed reescrito: admin hashed admin1234, operadores hashed 1111/2222/3333
4 Porta das traseiras fechada: AUTH_DEV_AUTOLOGIN ignorado quando NODE_ENV=production, em ambas as apps
5 operator-pwa: Credentials provider usa PIN + allowedRoles:['OPERATOR']; cookies fieldops-op.*
6 Picker em 2 estados: lista → teclado PIN (botões grandes, dots de progresso, mensagem de erro sem dar pistas)
7 admin-web: Auth.js completo (auth.config, auth.ts, route handler, middleware, /login page, AUTH_SECRET no env) com cookies fieldops-admin.*
8 scripts/auth-smoke.ts (11/11 ✓); .env.example e README atualizados

packages/db/src/crypto.ts

@@ -0,0 +1,23 @@
+import { randomBytes, scrypt as _scrypt, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+
+const scrypt = promisify(_scrypt);
+const KEYLEN = 64;
+
+/** Returns "scrypt$<saltHex>$<hashHex>". Works for both passwords (admin) and PINs (operator). */
+export async function hashSecret(plain: string): Promise<string> {
+  const salt = randomBytes(16);
+  const derived = (await scrypt(plain, salt, KEYLEN)) as Buffer;
+  return `scrypt$${salt.toString('hex')}$${derived.toString('hex')}`;
+}
+
+/** Constant-time verification. Returns false for null/malformed stored values — never throws. */
+export async function verifySecret(plain: string, stored: string | null): Promise<boolean> {
+  if (!stored) return false;
+  const [scheme, saltHex, hashHex] = stored.split('$');
+  if (scheme !== 'scrypt' || !saltHex || !hashHex) return false;
+  const salt = Buffer.from(saltHex, 'hex');
+  const expected = Buffer.from(hashHex, 'hex');
+  const derived = (await scrypt(plain, salt, expected.length)) as Buffer;
+  return derived.length === expected.length && timingSafeEqual(derived, expected);
+}

packages/db/src/index.ts

@@ -2,3 +2,4 @@ export { prisma, type DbClient } from './client';
 export { tenantScoped, type TenantScopedClient } from './tenant-extension';
 export { Prisma, UserRole, MaintenanceRequestStatus } from '@prisma/client';
 export type { User, Tenant, Workstation, DomainEvent, MaintenanceRequest } from '@prisma/client';
+export { hashSecret, verifySecret } from './crypto';