M1 (partial): tRPC API layer, storage, and three real fixes

Stands up packages/api so the swipe path stops trusting its caller, and
puts the auth library behind an interface we own.

- packages/api: tRPC v11 with a Session type WE define, not one
  re-exported from an auth library. Swapping providers means rewriting
  one SessionResolver, not touching a router.
- Procedure layers: public / protected / client / pro / verifiedPro /
  admin. Admin routes 404 rather than 403 so they cannot be probed.
- deck router replaces the untrusted server action. Ownership is checked
  on every operation and returns NOT_FOUND, never FORBIDDEN, so job ids
  cannot be enumerated. 23 tests, mostly authorization.
- packages/storage: presigned direct-to-R2 uploads. The server picks the
  key, so a caller can only write under their own user id. 14 tests.

Three defects found and fixed:
- The lazy db Proxy failed drizzle's is(db, PgDatabase) because it did
  not trap getPrototypeOf. Auth adapters dispatch on exactly that check,
  so this would have failed at runtime inside third-party code. Fixed
  and pinned with a regression test.
- The open-request cap was a read-then-write race: concurrent swipes
  could both read 4 and both insert. Now one transaction with the job
  row locked. The cap is checked before the tombstone is written, so a
  rejected swipe leaves no trace and the card stays on the deck.
- superjson was configured in two of the three required places. Without
  the QueryClient dehydrate/hydrate pair, RSC-prefetched data arrives as
  a raw envelope with no type error to warn you.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/db/src/client.ts

@@ -59,6 +59,25 @@ export const db: Db = new Proxy({} as Db, {
   has(_target, prop) {
     return Reflect.has(getDb() as object, prop);
   },
+  /**
+   * Without this trap the proxy reports Object.prototype, which breaks both
+   * `instanceof` and drizzle's own `is(value, PgDatabase)` — the latter walks
+   * `Object.getPrototypeOf(value).constructor` looking for an entityKind.
+   * Auth adapters and other drizzle-aware libraries dispatch on exactly that
+   * check, so a lazy handle that lies about its prototype fails at runtime in
+   * ways that are painful to trace back here.
+   */
+  getPrototypeOf() {
+    return Reflect.getPrototypeOf(getDb() as object);
+  },
+  ownKeys() {
+    return Reflect.ownKeys(getDb() as object);
+  },
+  getOwnPropertyDescriptor(_target, prop) {
+    const descriptor = Reflect.getOwnPropertyDescriptor(getDb() as object, prop);
+    // A proxy may only report a non-configurable property if the target has one.
+    return descriptor && { ...descriptor, configurable: true };
+  },
 });
 
 /** Close the pool. For scripts and test teardown — never call this from a request. */

packages/db/test/client.test.ts

@@ -0,0 +1,50 @@
+/**
+ * The db handle is a lazy Proxy. These tests exist because a proxy that lies
+ * about its prototype breaks drizzle's own runtime type dispatch — and the
+ * failure surfaces deep inside a third-party adapter, nowhere near this file.
+ */
+import { config } from 'dotenv';
+import { is } from 'drizzle-orm';
+import { PgDatabase } from 'drizzle-orm/pg-core';
+import { afterAll, describe, expect, it } from 'vitest';
+
+config({ path: '../../.env' });
+
+const { closePool, db } = await import('../src/client');
+
+afterAll(async () => {
+  await closePool();
+});
+
+describe('lazy db proxy', () => {
+  it('passes the drizzle is() check that adapters dispatch on', () => {
+    // Auth adapters dispatch on this. If it returns false they silently take a
+    // different code path and fail with an unrelated-looking error.
+    expect(is(db, PgDatabase)).toBe(true);
+  });
+
+  it('satisfies instanceof', () => {
+    expect(db instanceof PgDatabase).toBe(true);
+  });
+
+  it('exposes the query builders', () => {
+    expect(typeof db.select).toBe('function');
+    expect(typeof db.insert).toBe('function');
+    expect(typeof db.transaction).toBe('function');
+    expect(db.query).toBeDefined();
+  });
+
+  it('reports the relational query namespaces', () => {
+    expect(Object.keys(db.query)).toContain('jobs');
+    expect(Object.keys(db.query)).toContain('proProfiles');
+  });
+
+  it('supports the in operator', () => {
+    expect('select' in db).toBe(true);
+    expect('definitelyNotAMethod' in db).toBe(false);
+  });
+
+  it('returns the same instance across accesses', () => {
+    expect(db.select).toBe(db.select);
+  });
+});