feat: add authentication, user management, and admin features

Added comprehensive authentication and authorization system:

Authentication System:
- Better Auth integration with session management
- Login/logout pages and API routes
- Middleware for route protection
- Auth utilities and client libraries

User Management:
- User list, detail, and invite pages
- User API endpoints (CRUD operations)
- Session management for users
- Profile settings page

Role-Based Access Control:
- Role management pages (list, create, edit)
- Permission system with granular controls
- Role assignment to users
- Role API endpoints

Admin Features:
- Audit log page for tracking system events
- Admin settings page
- Audit service for logging user actions

Additional Features:
- Quotes management pages and components
- SalesBldr API integration
- Email service for notifications

Configuration & Documentation:
- Updated docker-compose.yml
- MCP server configuration (mcp.json)
- CVE-2025-55182 security review documentation
- Standards guide and PRD documents
- Re-enabling authentication documentation

Database Migrations:
- 012: Auth tables (users, sessions, accounts, verifications)
- 013: Role tables (roles, permissions, role_permissions, user_roles)
- 014: Admin settings table

UI Updates:
- Updated dashboard layout
- Enhanced app layout with auth integration

app/api/admin/settings/route.ts

@@ -0,0 +1,88 @@
+import { NextRequest, NextResponse } from "next/server";
+import { Pool } from "pg";
+import { requireAdmin, requireSuperAdmin, getSession } from "@/lib/auth-utils";
+import { audit } from "@/lib/services/audit";
+
+const pool = new Pool({
+  connectionString: process.env.DATABASE_URL,
+});
+
+// GET /api/admin/settings - Get all app settings
+export async function GET(request: NextRequest) {
+  const { error } = await requireAdmin();
+  if (error) return error;
+
+  try {
+    const result = await pool.query(
+      `SELECT key, value, description FROM "app_settings" ORDER BY key`
+    );
+
+    // Convert to key-value object
+    const settings: Record<string, string> = {};
+    result.rows.forEach((row) => {
+      settings[row.key] = row.value;
+    });
+
+    return NextResponse.json({ settings });
+  } catch (error) {
+    console.error("Error fetching settings:", error);
+    return NextResponse.json(
+      { error: "Failed to fetch settings" },
+      { status: 500 }
+    );
+  }
+}
+
+// PATCH /api/admin/settings - Update app settings
+export async function PATCH(request: NextRequest) {
+  const { session, error } = await requireSuperAdmin();
+  if (error) return error;
+
+  try {
+    const body = await request.json();
+    const { settings } = body;
+
+    if (!settings || typeof settings !== "object") {
+      return NextResponse.json(
+        { error: "Settings object is required" },
+        { status: 400 }
+      );
+    }
+
+    // Update each setting
+    for (const [key, value] of Object.entries(settings)) {
+      // Get old value for audit
+      const oldResult = await pool.query(
+        'SELECT value FROM "app_settings" WHERE key = $1',
+        [key]
+      );
+      const oldValue = oldResult.rows[0]?.value;
+
+      await pool.query(
+        `INSERT INTO "app_settings" (id, key, value, updated_at)
+         VALUES ($1, $2, $3, NOW())
+         ON CONFLICT (key) DO UPDATE SET value = $3, updated_at = NOW()`,
+        [`setting_${key}`, key, value]
+      );
+
+      // Audit log
+      if (session?.user) {
+        await audit.settingsUpdated(
+          session.user.id,
+          session.user.email,
+          key,
+          oldValue,
+          value
+        );
+      }
+    }
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error("Error updating settings:", error);
+    return NextResponse.json(
+      { error: "Failed to update settings" },
+      { status: 500 }
+    );
+  }
+}