Add email & password auth provider backed by Neo4j

[issuetopr-dev]

Summary

• Introduces a new NextAuth Credentials provider (id: "email-password") for email/password authentication.
• Implements Neo4j-backed user storage and verification with bcryptjs hashing.
• Adds a registration API endpoint to create accounts without email verification for now.
• Keeps existing GitHub App authentication intact and compatible.

Details

1. NextAuth provider

• Added Credentials provider alongside the existing GitHub App provider.
• For email/password sign-ins, the session token includes:
  • authMethod: "email-password"
  • profile.login: user email (so code expecting profile.login remains consistent)
• Existing token refresh and Redis caching remain for GitHub App; credentials logins are JWT-only.

2. Neo4j integration

• New repository: lib/neo4j/repositories/userAuth.ts
  • findUserByEmail(tx, email)
  • createUserWithEmailPassword(tx, email, passwordHash)
• New service: lib/neo4j/services/auth.ts
  • registerUserEmailPassword({ email, password })
  • verifyEmailPassword({ email, password })
• Uses bcryptjs for hashing and comparison.

3. Registration endpoint

• New route: POST /api/auth/email/register
  • Body: { email, password, confirmPassword }
  • Validates email format and matching passwords.
  • Creates a User node with username=email, email, passwordHash, createdAt in Neo4j.

Notes

• No email verification implemented per request.
• Username/ID is the email to keep things consistent with other code paths.
• Kept existing OAuth migration guard, but now sessions with authMethod === "email-password" are also accepted.

Follow-ups (optional)

• Add UI for email/password sign in and sign up flows (buttons/forms) as desired.
• Consider adding unique constraints in Neo4j for User(username) to enforce uniqueness.
• Optionally add a logout/session management UI for credentials users.

Checks

• ESLint passes locally (next lint).
• No breaking changes to GitHub App authentication code path.

Closes #1344

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}