feat: dashboard Second Brain, essai 7 jours et vérification e-mail

Rendre le dashboard actionnable (inbox, peek, carte mentale), aligner la facturation sur l’essai 7 jours, et bloquer le login e-mail tant que l’adresse n’est pas confirmée.

Co-authored-by: Cursor <cursoragent@cursor.com>

memento-note/app/actions/auth.ts

@@ -2,20 +2,49 @@
 
 import { signIn } from '@/auth';
 import { AuthError } from 'next-auth';
+import bcrypt from 'bcryptjs';
+import prisma from '@/lib/prisma';
 
 export async function authenticate(
   prevState: string | undefined,
   formData: FormData,
 ) {
+  const emailRaw = formData.get('email');
+  const passwordRaw = formData.get('password');
+  const email = typeof emailRaw === 'string' ? emailRaw.toLowerCase().trim() : '';
+  const password = typeof passwordRaw === 'string' ? passwordRaw : '';
+
+  // Surface a clear message when credentials are valid but email is unverified.
+  if (email && password.length >= 6) {
+    try {
+      const user = await prisma.user.findUnique({ where: { email } });
+      if (user?.password) {
+        const match = await bcrypt.compare(password, user.password);
+        if (match && !user.emailVerified) {
+          return 'EMAIL_NOT_VERIFIED';
+        }
+      }
+    } catch (preCheckErr) {
+      console.error('[authenticate] emailVerified pre-check failed:', preCheckErr);
+    }
+  }
+
   try {
     await signIn('credentials', {
-      email: formData.get('email'),
-      password: formData.get('password'),
+      email,
+      password,
       redirectTo: '/home',
     });
   } catch (error) {
     if (error instanceof AuthError) {
       console.error('AuthError details:', error.type, error.message);
+      if (
+        error.type === 'CredentialsSignin' &&
+        (error.message?.includes('EMAIL_NOT_VERIFIED') ||
+          (error.cause as { err?: Error } | undefined)?.err?.message === 'EMAIL_NOT_VERIFIED')
+      ) {
+        return 'EMAIL_NOT_VERIFIED';
+      }
       switch (error.type) {
         case 'CredentialsSignin':
           return 'Invalid credentials.';