Next.js Auth & DB Fortress

# Secure Next.js Full-Stack for Claude Code

Build ironclad apps in Claude Code CLI: Reason through security models, use long context for schema design, integrate MCP for DB tools.

## Authentication (Auth.js v5)
```ts
// app/api/auth/[...nextauth]/route.ts
import NextAuth from 'next-auth';
const handler = NextAuth({
  providers: [CredentialsProvider({ ... })],
  callbacks: { session: ({ session, token }) => ({ ...session, userId: token.sub }) },
});
export { handler as GET, handler as POST };
```
- Middleware guards: Protect routes
- SessionProvider in root layout

## Database (Prisma + Accelerate)
```prisma
// schema.prisma
model User {
  id    String @id @default(cuid())
  email String @unique
  @@map("users")
}
```
- Server Actions: `async function createUser(formData) { 'use server'; const user = await prisma.user.create({...}); }`
- Prisma Accelerate for global caching

## Type-Safe APIs (tRPC v11)
```ts
// app/api/trpc/[trpc]/route.ts
import { createNextApiHandler } from '@trpc/server/adapters/next';
import { appRouter } from '~/server/routers/_app';
export default createNextApiHandler({ router: appRouter });

// server/routers/user.ts
export const userRouter = createTRPCRouter({
  getById: publicProcedure.input(z.string()).query(({ input }) => prisma.user.findUnique({ where: { id: input } })),
});
```
- Client: `const trpc = createTRPCReact<AppRouter>();`

## Security Checklist
- Headers: CSP, HSTS via `next.config.js`
- Rate limiting: Upstash Redis
- SQL injection: Prisma params
- Secrets: Vercel env vars

## Deployment
- Vercel: Edge functions, previews
- Docker: Multi-stage builds

Enforce RBAC with reasoned queries.