refactor(auth): single digest registry, extracted 2FA and login-log, dep bumps

- password.ts: derive plain and salted digest detection from one DIGEST_SCHEMES
  table instead of parallel hardcoded lists, so adding a family is one row.
- auth.ts: move 2FA challenge verification into twofactor-verification.ts and
  the website login-log insert into website-login-log.ts, slimming the
  NextAuth provider to orchestration only.
- deps: bump @formatjs/icu-messageformat-parser, @tanstack/react-query, jszip,
  lucide-react, motion (patch/minor only). @types/react stay pinned per
  pnpm-workspace.yaml; next-auth is already at the newest available (v5 beta).

src/lib/auth/website-login-log.ts

@@ -0,0 +1,24 @@
+import { db, WebsiteLoginLogs } from "@/lib/db";
+import { logger } from "@/lib/logger";
+
+/**
+ * Records a successful login for the user's "session logs" page. Best-effort:
+ * always produces a real User-Agent header value, never blocks sign-in.
+ */
+export async function recordWebsiteLogin(
+	userId: number,
+	ip: string,
+): Promise<void> {
+	try {
+		const { headers } = await import("next/headers");
+		const ua = (await headers()).get("user-agent")?.slice(0, 512) ?? null;
+		await db.insert(WebsiteLoginLogs).values({
+			userId,
+			ip,
+			userAgent: ua,
+			createdAt: new Date(),
+		});
+	} catch {
+		logger.warn("Failed to record login log for user", { userId });
+	}
+}