feat: Sprint 1 slice 1 — API signup + web signup/chat shell

- api: Fastify POST /auth/signup (validation, scrypt hash, in-memory store)
- web: React+Vite SignUp form and chat shell with dev proxy
- 35 tests green (api 5, web 2, e2e 28)

api/__tests__/auth.test.ts

@@ -0,0 +1,61 @@
+import { describe, it, expect } from 'vitest';
+import { buildApp } from '../src/app.ts';
+
+describe('POST /auth/signup', () => {
+  it('creates a user and returns a session token', async () => {
+    const app = await buildApp();
+    const res = await app.inject({
+      method: 'POST',
+      url: '/auth/signup',
+      payload: { email: 'a@example.com', password: 'password123' },
+    });
+
+    expect(res.statusCode).toBe(201);
+    const body = res.json();
+    expect(body.user.email).toBe('a@example.com');
+    expect(body.user.id).toBeTruthy();
+    expect(body.sessionToken).toBeTruthy();
+  });
+
+  it('rejects an invalid email with 400', async () => {
+    const app = await buildApp();
+    const res = await app.inject({
+      method: 'POST',
+      url: '/auth/signup',
+      payload: { email: 'not-an-email', password: 'password123' },
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+
+  it('rejects a short password with 400', async () => {
+    const app = await buildApp();
+    const res = await app.inject({
+      method: 'POST',
+      url: '/auth/signup',
+      payload: { email: 'a@example.com', password: 'short' },
+    });
+
+    expect(res.statusCode).toBe(400);
+  });
+
+  it('rejects a duplicate email with 409', async () => {
+    const app = await buildApp();
+    const payload = { email: 'a@example.com', password: 'password123' };
+    await app.inject({ method: 'POST', url: '/auth/signup', payload });
+    const res = await app.inject({ method: 'POST', url: '/auth/signup', payload });
+
+    expect(res.statusCode).toBe(409);
+  });
+
+  it('does not return the password hash', async () => {
+    const app = await buildApp();
+    const res = await app.inject({
+      method: 'POST',
+      url: '/auth/signup',
+      payload: { email: 'a@example.com', password: 'password123' },
+    });
+
+    expect(res.json().user.passwordHash).toBeUndefined();
+  });
+});

api/package.json

@@ -2,5 +2,18 @@
   "name": "@wursor/api",
   "private": true,
   "type": "module",
-  "scripts": {}
+  "scripts": {
+    "test": "vitest run",
+    "dev": "tsx watch src/index.ts",
+    "start": "tsx src/index.ts"
+  },
+  "dependencies": {
+    "fastify": "^5.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "tsx": "^4.20.3",
+    "typescript": "^5.9.2",
+    "vitest": "^3.2.4"
+  }
 }

api/src/app.ts

@@ -0,0 +1,10 @@
+import Fastify from 'fastify';
+import { authRoutes } from './routes/auth.ts';
+import { InMemoryUserStore } from './services/user-store.ts';
+
+export async function buildApp() {
+  const app = Fastify();
+  const store = new InMemoryUserStore();
+  await authRoutes(app, store);
+  return app;
+}

api/src/index.ts

@@ -0,0 +1,6 @@
+import { buildApp } from './app.ts';
+
+const port = Number(process.env.PORT ?? 3000);
+const app = await buildApp();
+
+await app.listen({ port, host: '0.0.0.0' });

api/src/lib/crypto.ts

@@ -0,0 +1,24 @@
+import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from 'node:crypto';
+
+export function hashPassword(password: string): string {
+  const salt = randomBytes(16).toString('hex');
+  const hash = scryptSync(password, salt, 32).toString('hex');
+  return `${salt}:${hash}`;
+}
+
+export function verifyPassword(password: string, stored: string): boolean {
+  const [salt, hash] = stored.split(':');
+  if (salt === undefined || hash === undefined) {
+    return false;
+  }
+  const candidate = scryptSync(password, salt, 32);
+  return timingSafeEqual(candidate, Buffer.from(hash, 'hex'));
+}
+
+export function newToken(): string {
+  return randomBytes(32).toString('hex');
+}
+
+export function newId(): string {
+  return randomUUID();
+}

api/src/routes/auth.ts

@@ -0,0 +1,30 @@
+import type { FastifyInstance } from 'fastify';
+import { hashPassword, newId, newToken } from '../lib/crypto.ts';
+import type { UserStore } from '../services/user-store.ts';
+
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+type SignupBody = {
+  email?: string;
+  password?: string;
+};
+
+export async function authRoutes(app: FastifyInstance, store: UserStore): Promise<void> {
+  app.post('/auth/signup', async (request, reply) => {
+    const { email: rawEmail, password } = request.body as SignupBody;
+    const email = rawEmail?.trim().toLowerCase();
+
+    if (email === undefined || email === '' || !EMAIL_RE.test(email)) {
+      return reply.status(400).send({ error: 'invalid_email' });
+    }
+    if (password === undefined || password.length < 8) {
+      return reply.status(400).send({ error: 'weak_password' });
+    }
+    if (store.findByEmail(email) !== undefined) {
+      return reply.status(409).send({ error: 'email_exists' });
+    }
+
+    const user = store.create({ id: newId(), email, passwordHash: hashPassword(password) });
+    return reply.status(201).send({ user: { id: user.id, email: user.email }, sessionToken: newToken() });
+  });
+}

api/src/services/user-store.ts

@@ -0,0 +1,23 @@
+export type User = {
+  id: string;
+  email: string;
+  passwordHash: string;
+};
+
+export interface UserStore {
+  findByEmail(email: string): User | undefined;
+  create(user: User): User;
+}
+
+export class InMemoryUserStore implements UserStore {
+  private byEmail = new Map<string, User>();
+
+  findByEmail(email: string): User | undefined {
+    return this.byEmail.get(email);
+  }
+
+  create(user: User): User {
+    this.byEmail.set(user.email, user);
+    return user;
+  }
+}