feat(auth): restore Google sign-in and AI admin test routes

Google OAuth was implemented locally but never deployed; the login button
only renders when AUTH_GOOGLE_ID and AUTH_GOOGLE_SECRET are set. Also
restores /api/ai/test-* endpoints removed by mistake and wires Google
credentials into deploy workflows.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/auth.ts

@@ -1,56 +1,60 @@
 import NextAuth from 'next-auth';
+import { PrismaAdapter } from '@auth/prisma-adapter';
 import { authConfig } from './auth.config';
-import Credentials from 'next-auth/providers/credentials';
-import { z } from 'zod';
 import prisma from '@/lib/prisma';
-import bcrypt from 'bcryptjs';
-import { rateLimit } from '@/lib/rate-limit';
+import { buildAuthProviders } from '@/lib/auth-providers';
 
 export const { auth, signIn, signOut, handlers } = NextAuth({
   ...authConfig,
-  providers: [
-    Credentials({
-      async authorize(credentials) {
-        try {
-          const parsedCredentials = z
-            .object({ email: z.string().email(), password: z.string().min(6) })
-            .safeParse(credentials);
-
-          if (!parsedCredentials.success) {
-            return null;
-          }
-
-          const { email, password } = parsedCredentials.data;
-
-          const { allowed } = rateLimit(`login:${email.toLowerCase()}`)
-          if (!allowed) {
-            return null;
-          }
-
-          const user = await prisma.user.findUnique({ 
-            where: { email: email.toLowerCase() } 
+  adapter: PrismaAdapter(prisma),
+  providers: buildAuthProviders(),
+  events: {
+    async createUser({ user }) {
+      const adminEmail = process.env.ADMIN_EMAIL?.toLowerCase();
+      if (!adminEmail || !user.id || user.email?.toLowerCase() !== adminEmail) {
+        return;
+      }
+      await prisma.user.update({
+        where: { id: user.id },
+        data: { role: 'ADMIN', emailVerified: new Date() },
+      });
+    },
+  },
+  callbacks: {
+    ...authConfig.callbacks,
+    async signIn({ user, account }) {
+      if (account?.provider === 'google' && user.email) {
+        const email = user.email.toLowerCase();
+        const adminEmail = process.env.ADMIN_EMAIL?.toLowerCase();
+        const existing = await prisma.user.findUnique({ where: { email } });
+        if (existing && adminEmail && email === adminEmail && existing.role !== 'ADMIN') {
+          await prisma.user.update({
+            where: { id: existing.id },
+            data: { role: 'ADMIN', emailVerified: new Date() },
           });
-
-          if (!user || !user.password) {
-            return null;
-          }
-
-          const passwordsMatch = await bcrypt.compare(password, user.password);
-
-          if (passwordsMatch) {
-            return {
-              id: user.id,
-              email: user.email,
-              name: user.name,
-              role: user.role,
-            };
-          }
-
-          return null;
-        } catch {
-          return null;
         }
-      },
-    }),
-  ],
+      }
+      return true;
+    },
+    async jwt({ token, user }) {
+      if (user?.id) {
+        token.id = user.id;
+        const dbUser = await prisma.user.findUnique({
+          where: { id: user.id },
+          select: { role: true },
+        });
+        token.role = dbUser?.role ?? 'USER';
+      } else if (token.sub) {
+        const dbUser = await prisma.user.findUnique({
+          where: { id: token.sub },
+          select: { role: true },
+        });
+        if (dbUser) {
+          token.id = token.sub;
+          token.role = dbUser.role;
+        }
+      }
+      return token;
+    },
+  },
 });