feat(auth): add shared authentication state and user-session model

[ayushtr-aws]

Summary

Implements TG-15: Define authentication state and user session model from the Add user sign-in functionality epic.

Adds a framework-agnostic authentication and user-session model under soccer-app/src/auth/ that both the UI and service layer can consume:

• types.ts — Typed states as a discriminated AuthState union: loading, signedOut, signedIn (carries a UserSession), and expired (carries the User). Includes User, UserSession, and AuthStatus types, plus authState convenience constructors.
• validation.ts — Pure validation/derivation helpers: isValidEmail, isValidPassword, isValidUser, isValidSession, isSessionExpired, isSessionActive, deriveAuthState, and isAuthenticated.
• index.ts — Public barrel export for the module.
• auth.test.ts — 22 focused unit tests covering every state constructor and helper (valid/invalid/expired paths).

Naming, routes, fields and shapes follow the shared orchestration context so they align with sibling sub-issues.

Tooling

• Added vitest as a dev dependency and a test npm script (vitest run). No test runner previously existed in this repo.

Build & test results

All run from repo root:

• mise run build (tsc -b && vite build) — PASS (built in ~107ms, 20 modules transformed).
• mise run lint (oxlint) — PASS (no warnings/errors).
• npm test (vitest run) — PASS (1 file, 22/22 tests passing).

Decisions made

• The task specifies only the model, so no UI, routes, or service wiring were added — those belong to sibling sub-issues.
• Chose a discriminated union keyed on status for exhaustive, type-safe narrowing.
• expired state carries the User (not the full session) so the UI can greet the returning user while requiring re-authentication.
• Password policy is minimal (≥ 8 chars) as a client-side sanity check; authoritative validation remains server-side.
• Introduced vitest since the repo had no test infrastructure; it integrates cleanly with the existing Vite setup.

Agent notes

• What went well: The repo is a small, clean Vite + React 19 + TypeScript app. Build and lint tasks are wired through mise. Adding an isolated src/auth module with no framework coupling was low-risk, and the strict tsconfig.app.json (verbatimModuleSyntax, noUnusedLocals) caught issues early.
• Difficult/notable: There was no pre-existing test runner, so vitest was added. The build's tsc -b compiles the test file too, so tests must stay type-clean.
• Conventions discovered: Conventional-commit messages with a module scope; oxlint for linting; strict TS config using bundler module resolution and verbatimModuleSyntax (use import type for type-only imports).
• Suggestions for future tasks: Consider adding a test task to mise.toml for parity with build/lint. The sign-in UI and service-layer sub-issues can import from src/auth and use deriveAuthState to map a persisted/restored session to the correct state.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.