feat: add authentication, user management, and admin features

Added comprehensive authentication and authorization system:

Authentication System:
- Better Auth integration with session management
- Login/logout pages and API routes
- Middleware for route protection
- Auth utilities and client libraries

User Management:
- User list, detail, and invite pages
- User API endpoints (CRUD operations)
- Session management for users
- Profile settings page

Role-Based Access Control:
- Role management pages (list, create, edit)
- Permission system with granular controls
- Role assignment to users
- Role API endpoints

Admin Features:
- Audit log page for tracking system events
- Admin settings page
- Audit service for logging user actions

Additional Features:
- Quotes management pages and components
- SalesBldr API integration
- Email service for notifications

Configuration & Documentation:
- Updated docker-compose.yml
- MCP server configuration (mcp.json)
- CVE-2025-55182 security review documentation
- Standards guide and PRD documents
- Re-enabling authentication documentation

Database Migrations:
- 012: Auth tables (users, sessions, accounts, verifications)
- 013: Role tables (roles, permissions, role_permissions, user_roles)
- 014: Admin settings table

UI Updates:
- Updated dashboard layout
- Enhanced app layout with auth integration

lib/auth.ts

@@ -0,0 +1,92 @@
+import { betterAuth } from "better-auth";
+import { magicLink, twoFactor, admin } from "better-auth/plugins";
+import { nextCookies } from "better-auth/next-js";
+import { Pool } from "pg";
+import { sendMagicLinkEmail } from "./services/email";
+import { ac, adminRole, userRole, superAdminRole } from "./permissions";
+
+// Create a PostgreSQL pool for Better Auth
+const pool = new Pool({
+  connectionString: process.env.DATABASE_URL,
+});
+
+export const auth = betterAuth({
+  database: pool,
+  appName: "Pulse",
+  baseURL: process.env.BETTER_AUTH_URL,
+  secret: process.env.BETTER_AUTH_SECRET,
+  trustedOrigins: [
+    "http://localhost:3100",
+    "https://pulse.wulfconsulting.cloud"
+  ],
+
+  // Email & Password disabled - using magic link and Microsoft OAuth only
+  emailAndPassword: {
+    enabled: false,
+  },
+
+  // Session configuration
+  session: {
+    expiresIn: parseInt(process.env.SESSION_TIMEOUT_SECONDS || "86400"),
+    updateAge: 60 * 60, // Update session every hour
+    cookieCache: {
+      enabled: true,
+      maxAge: 5 * 60, // 5 minutes
+    },
+  },
+
+  // Social providers
+  socialProviders: {
+    microsoft: {
+      clientId: process.env.MICROSOFT_CLIENT_ID || "",
+      clientSecret: process.env.MICROSOFT_CLIENT_SECRET || "",
+      tenantId: process.env.MICROSOFT_TENANT_ID || "common",
+    },
+  },
+
+  // Plugins
+  plugins: [
+    // Magic link authentication
+    magicLink({
+      sendMagicLink: async ({ email, url, token }) => {
+        await sendMagicLinkEmail({ email, url, token });
+      },
+      expiresIn: 300, // 5 minutes
+    }),
+
+    // Two-factor authentication
+    twoFactor({
+      issuer: "Pulse",
+    }),
+
+    // Admin plugin with RBAC
+    admin({
+      ac,
+      roles: {
+        "super-admin": superAdminRole,
+        admin: adminRole,
+        user: userRole,
+      },
+    }),
+
+    // Next.js cookie handling - must be last
+    nextCookies(),
+  ],
+
+  // User configuration
+  user: {
+    additionalFields: {
+      role: {
+        type: "string",
+        defaultValue: "user",
+      },
+      requires_setup: {
+        type: "boolean",
+        defaultValue: false,
+      },
+    },
+  },
+});
+
+export type Session = typeof auth.$Infer.Session;
+export type User = typeof auth.$Infer.Session.user;