Add Authentik OIDC integration (task 06)

- next-auth@beta + @auth/drizzle-adapter wired up with database sessions
- src/lib/auth.ts: OIDC provider, authorized callback, signIn household-attach, getCurrentUser()
- src/middleware.ts: protects all routes except /login, /s/*, /api/auth/*
- src/app/api/auth/[...nextauth]/route.ts: mounts Auth.js handlers
- src/app/login/page.tsx: single SSO sign-in button (server action)
- Schema: users extended (name/emailVerified/image), accounts/sessions/verificationTokens added
- drizzle/0001_auth_tables.sql: migration for schema changes
- deploy/authentik/README.md: manual bootstrap steps for Authentik
- src/lib/db.ts: pass schema to drizzle for relational query builder

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,3 @@
+import { handlers } from "@/lib/auth";
+
+export const { GET, POST } = handlers;

src/app/login/page.tsx

@@ -0,0 +1,22 @@
+import { signIn } from "@/lib/auth";
+import { Button } from "@/components/ui/button";
+
+export default function LoginPage() {
+  return (
+    <main className="flex min-h-screen flex-col items-center justify-center p-8">
+      <div className="flex flex-col items-center gap-6">
+        <h1 className="text-4xl font-bold">famapp</h1>
+        <form
+          action={async () => {
+            "use server";
+            await signIn("authentik", { redirectTo: "/" });
+          }}
+        >
+          <Button type="submit" size="lg">
+            Sign in with SSO
+          </Button>
+        </form>
+      </div>
+    </main>
+  );
+}