docs(01-03): complete local env setup and auth flow verification

All 7 auth flow tests passed (human verified). Fixed Edge Runtime
middleware incompatibility and (protected) route group split.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.planning/phases/01-foundation/01-03-SUMMARY.md

@@ -0,0 +1,51 @@
+---
+plan: 01-03
+phase: 01-foundation
+status: complete
+completed: 2026-03-19
+---
+
+# Plan 01-03: Local Environment Setup & Auth Flow Verification
+
+## Outcome
+
+Local development environment fully operational. All 7 auth flow tests passed (human verified).
+
+## What Was Done
+
+- Switched database driver from `@neondatabase/serverless` to `postgres.js` for local PostgreSQL compatibility
+- Started PostgreSQL 16 via Docker (`tcr-db` container on port 5432)
+- Created `.env.local` with `DATABASE_URL`, `AUTH_SECRET`, `AGENT_EMAIL`, `AGENT_PASSWORD`
+- Ran `db:migrate` — users table applied to local Neon
+- Ran `db:seed` — Teressa's account created with bcrypt-hashed password
+- Fixed two bugs discovered during verification:
+  1. Middleware Edge Runtime incompatibility (postgres.js is Node.js-only) — resolved by splitting `auth.config.ts` (Edge-safe) from `auth.ts` (full)
+  2. `/agent/layout.tsx` caused infinite redirect loop on `/agent/login` — resolved by moving dashboard into `(protected)` route group
+- App running at `http://localhost:3000`
+
+## Human Verification — All 7 Tests Passed ✓
+
+1. `/agent/dashboard` while unauthenticated → redirects to `/agent/login` ✓
+2. Wrong credentials → "Invalid email or password" (no field hint) ✓
+3. Correct credentials → lands on `/agent/dashboard` ✓
+4. Tab close + reopen → still logged in (7-day JWT cookie) ✓
+5. Logout → `/agent/login` with "You've been signed out" ✓
+6. Post-logout `/agent/dashboard` → redirects to login ✓
+7. Password show/hide toggle → works ✓
+
+## Key Files Modified
+
+- `src/lib/auth.config.ts` — NEW: Edge-safe auth config for middleware
+- `src/lib/auth.ts` — Simplified to extend auth.config
+- `middleware.ts` — Uses auth.config only (no DB import in Edge Runtime)
+- `src/app/agent/(protected)/layout.tsx` — Auth layout scoped to protected routes only
+- `src/app/agent/(protected)/dashboard/page.tsx` — Moved into route group
+- `scripts/seed.ts` — Updated to postgres.js driver
+- `src/lib/db/index.ts` — Updated to postgres.js driver
+
+## Requirements Verified
+
+- AUTH-01: Login with email/password ✓
+- AUTH-02: 7-day session persistence ✓
+- AUTH-03: Route protection with redirect ✓
+- AUTH-04: Logout with confirmation ✓