feat: Sprint 1 slice 1 — API signup + web signup/chat shell

- api: Fastify POST /auth/signup (validation, scrypt hash, in-memory store)
- web: React+Vite SignUp form and chat shell with dev proxy
- 35 tests green (api 5, web 2, e2e 28)

api/src/app.ts

@@ -0,0 +1,10 @@
+import Fastify from 'fastify';
+import { authRoutes } from './routes/auth.ts';
+import { InMemoryUserStore } from './services/user-store.ts';
+
+export async function buildApp() {
+  const app = Fastify();
+  const store = new InMemoryUserStore();
+  await authRoutes(app, store);
+  return app;
+}

api/src/index.ts

@@ -0,0 +1,6 @@
+import { buildApp } from './app.ts';
+
+const port = Number(process.env.PORT ?? 3000);
+const app = await buildApp();
+
+await app.listen({ port, host: '0.0.0.0' });

api/src/lib/crypto.ts

@@ -0,0 +1,24 @@
+import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from 'node:crypto';
+
+export function hashPassword(password: string): string {
+  const salt = randomBytes(16).toString('hex');
+  const hash = scryptSync(password, salt, 32).toString('hex');
+  return `${salt}:${hash}`;
+}
+
+export function verifyPassword(password: string, stored: string): boolean {
+  const [salt, hash] = stored.split(':');
+  if (salt === undefined || hash === undefined) {
+    return false;
+  }
+  const candidate = scryptSync(password, salt, 32);
+  return timingSafeEqual(candidate, Buffer.from(hash, 'hex'));
+}
+
+export function newToken(): string {
+  return randomBytes(32).toString('hex');
+}
+
+export function newId(): string {
+  return randomUUID();
+}

api/src/routes/auth.ts

@@ -0,0 +1,30 @@
+import type { FastifyInstance } from 'fastify';
+import { hashPassword, newId, newToken } from '../lib/crypto.ts';
+import type { UserStore } from '../services/user-store.ts';
+
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+type SignupBody = {
+  email?: string;
+  password?: string;
+};
+
+export async function authRoutes(app: FastifyInstance, store: UserStore): Promise<void> {
+  app.post('/auth/signup', async (request, reply) => {
+    const { email: rawEmail, password } = request.body as SignupBody;
+    const email = rawEmail?.trim().toLowerCase();
+
+    if (email === undefined || email === '' || !EMAIL_RE.test(email)) {
+      return reply.status(400).send({ error: 'invalid_email' });
+    }
+    if (password === undefined || password.length < 8) {
+      return reply.status(400).send({ error: 'weak_password' });
+    }
+    if (store.findByEmail(email) !== undefined) {
+      return reply.status(409).send({ error: 'email_exists' });
+    }
+
+    const user = store.create({ id: newId(), email, passwordHash: hashPassword(password) });
+    return reply.status(201).send({ user: { id: user.id, email: user.email }, sessionToken: newToken() });
+  });
+}

api/src/services/user-store.ts

@@ -0,0 +1,23 @@
+export type User = {
+  id: string;
+  email: string;
+  passwordHash: string;
+};
+
+export interface UserStore {
+  findByEmail(email: string): User | undefined;
+  create(user: User): User;
+}
+
+export class InMemoryUserStore implements UserStore {
+  private byEmail = new Map<string, User>();
+
+  findByEmail(email: string): User | undefined {
+    return this.byEmail.get(email);
+  }
+
+  create(user: User): User {
+    this.byEmail.set(user.email, user);
+    return user;
+  }
+}