feat(F-003): implement auth domain Prisma schema and migration

Auth Domain (Complete):
- auth_user: Better Auth compatible with password, 2FA, SSO support
- auth_session: session management with IP and user agent tracking
- auth_account: OAuth provider accounts
- auth_oauth_client + tokens: OAuth client configuration and token management
- auth_user_type: role definitions (admin, customer, internal)
- auth_domain: multi-tenant domain grouping
- auth_password_history + reset: password security and recovery
- auth_permission_group + rule + category: RBAC system with granular permissions
- auth_security_question + answer: account recovery mechanism

Quest Domain (Partial - Core User/Company):
- quest_user: portal-specific user data (sub-user flag, API tokens)
- quest_company: customer/company info (Epicor integration, invoicing flags)
- quest_user_company: many-to-many with active company tracking

Migration applied successfully to PostgreSQL 16 database.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

TASKS.md

@@ -31,21 +31,21 @@
 - **Deps:** F-001 | **Est:** 1 hr (remaining) | **Status:** ✅ Complete
 
 ### F-003: Prisma Schema - Auth Domain
-- [ ] `auth_user` table (email, password hash, deactivated, verified, login counts, 2FA, SSO fields)
-- [ ] `auth_domain` table
-- [ ] `auth_user_type` table
-- [ ] `auth_oauth_client` + `auth_oauth_access_token` + `auth_oauth_refresh_token`
-- [ ] `auth_password_history` + `auth_password_reset`
-- [ ] `auth_permission_group` + `auth_permission_rule` + junction table
-- [ ] `auth_permission_rule_category`
-- [ ] `auth_security_question` + `auth_security_answer`
-- [ ] Run initial migration, verify schema
-- **Deps:** F-001 | **Est:** 4 hrs
+- [x] `auth_user` table (email, password hash, deactivated, verified, login counts, 2FA, SSO fields)
+- [x] `auth_domain` table
+- [x] `auth_user_type` table
+- [x] `auth_oauth_client` + `auth_oauth_access_token` + `auth_oauth_refresh_token`
+- [x] `auth_password_history` + `auth_password_reset`
+- [x] `auth_permission_group` + `auth_permission_rule` + junction table
+- [x] `auth_permission_rule_category`
+- [x] `auth_security_question` + `auth_security_answer`
+- [x] Run initial migration, verify schema
+- **Deps:** F-001 | **Est:** 4 hrs | **Status:** ✅ Complete
 
 ### F-004: Prisma Schema - Quest Domain
-- [ ] `quest_company` (EpicorCustID, display name, invoicing flags)
-- [ ] `quest_user` (FK to auth_user, IsSubUser, API token)
-- [ ] `quest_user_company` junction table
+- [x] `quest_company` (EpicorCustID, display name, invoicing flags)
+- [x] `quest_user` (FK to auth_user, IsSubUser, API token)
+- [x] `quest_user_company` junction table
 - [ ] `quest_account_request`
 - [ ] `quest_notification` + `quest_user_notification_alert_read`
 - [ ] `quest_email_event` + `quest_user_email_event` junction
@@ -53,7 +53,7 @@
 - [ ] `quest_plant` + `quest_inventory_type` + `quest_inventory_plant`
 - [ ] `quest_processed_order_acknowledgement_email`
 - [ ] Run migration, verify
-- **Deps:** F-003 | **Est:** 3 hrs
+- **Deps:** F-003 | **Est:** 3 hrs | **Status:** 🔨 In Progress
 
 ### F-005: Prisma Schema - Remaining Domains
 - [ ] `ship_request` + `ship_request_detail`