refactor: migrate backend to pnpm monorepo with Hono module architecture

- Replace Bun with pnpm 9 + Turborepo + tsx; apps/api renamed to apps/backend
- Split backend into http/, modules/, lib/ layers mirroring tai-specguard
- Add use-case + Result pattern, Problem Details RFC 7807, basePath /api/v1
- Mount Better Auth at /api/v1/auth, keep session-auth whitelist
- Split Prisma schema into prisma/models/*, generate into generated/
- Rework packages/shared into lib/ + schemas/ with pagination DTOs
- Implement health, groups, students, payments, waitlist modules
- Add vitest suite with prisma mocks (21 tests), biome lint
- Point web client to /api/v1/auth and /api/v1/groups/from-organization

apps/backend/test/session-auth.test.ts

@@ -0,0 +1,80 @@
+import { Hono } from 'hono';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('@/lib/prisma', () => ({
+  default: {
+    $queryRaw: vi.fn(),
+  },
+  getPrismaClient: vi.fn(),
+  UnitOfWork: class {},
+}));
+
+vi.mock('@/modules/auth/auth', () => ({
+  auth: {
+    api: {
+      getSession: vi.fn(),
+    },
+  },
+}));
+
+import {
+  isPublicApiRequest,
+  sessionAuthMiddleware,
+} from '@/http/session-auth';
+import { auth } from '@/modules/auth/auth';
+
+describe('session auth', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('classifies public API requests', () => {
+    expect(isPublicApiRequest('OPTIONS', '/api/v1/groups')).toBe(true);
+    expect(isPublicApiRequest('GET', '/api/v1/health')).toBe(true);
+    expect(isPublicApiRequest('POST', '/api/v1/auth/sign-in/email')).toBe(true);
+    expect(isPublicApiRequest('GET', '/api/v1/groups')).toBe(false);
+    expect(isPublicApiRequest('GET', '/api/v1/students')).toBe(false);
+  });
+
+  it('allows public requests without a session', async () => {
+    const app = new Hono();
+    app.use('*', sessionAuthMiddleware);
+    app.get('/api/v1/health', (c) => c.json({ status: 'ok' }));
+
+    const res = await app.request('/api/v1/health');
+
+    expect(res.status).toBe(200);
+    expect(auth.api.getSession).not.toHaveBeenCalled();
+  });
+
+  it('rejects protected requests without a session', async () => {
+    vi.mocked(auth.api.getSession).mockResolvedValue(null);
+
+    const app = new Hono();
+    app.use('*', sessionAuthMiddleware);
+    app.get('/api/v1/groups', (c) => c.json({}));
+
+    const res = await app.request('/api/v1/groups');
+
+    expect(res.status).toBe(401);
+    expect(await res.json()).toMatchObject({ code: 'unauthorized' });
+  });
+
+  it('sets the user and session for authenticated requests', async () => {
+    const session = {
+      user: { id: 'user-1', name: 'Ana' },
+      session: { id: 'session-1' },
+    };
+    vi.mocked(auth.api.getSession).mockResolvedValue(session as never);
+
+    const app = new Hono();
+    app.use('*', sessionAuthMiddleware);
+    app.get('/api/v1/groups', (c) => c.json({ userId: c.get('user').id }));
+
+    const res = await app.request('/api/v1/groups');
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ userId: 'user-1' });
+    expect(auth.api.getSession).toHaveBeenCalledTimes(1);
+  });
+});