docs: correct docs against portal-auth and mysql integration

[kevinrutledge]

Developer

Kevin Rutledge

What changed?

Documentation corrections plus toolchain housekeeping, on one branch.

Docs corrected against the merged integration (#217-#222). Login now validates through the portal's validatetoken and the app mints its own prfc_auth cookie, so architecture.md and the auth-patterns ADR were rewritten and a nonexistent /api/checksum route removed. The prisma-mysql ADR notes production runs MariaDB 5.5 through @prisma/adapter-mariadb with a hand-created schema, the ci-cd ADR notes the build no longer runs migrate deploy, getting-started.md drops the stale "e2e suite is skipped" note, src/README.md drops a nonexistent config/ directory, and test/README.md fixes the Vitest environment description.

• docs/architecture.md, docs/decisions/auth-patterns.md, docs/decisions/prisma-mysql.md, docs/decisions/ci-cd-pipeline.md, docs/getting-started.md, src/README.md, test/README.md

Bump vitest ^4.0.16 to ^4.1.8. Clears GHSA-5xrq-8626-4rwp, a dev-only Vitest UI server advisory and the only current finding from npm audit.

• package.json, package-lock.json

Drop the deprecated tsconfig baseUrl. TypeScript 7.0 deprecates it. Set the alias to "@/*": ["./src/*"], which resolves the same way relative to the config file. No ignoreDeprecations shim.

• tsconfig.json

Remove the Prisma seed and the deprecated package.json prisma key. Prisma 7 moves seed config to prisma.config.ts. The seed was unused by CI and e2e, so it was deleted along with the db:seed script and the package.json prisma key. faker stays, since mock-members.ts still uses it.

• prisma/seed.ts (deleted), package.json, docs/getting-started.md

Stop assigning undefined to process.env in the getSecret tests. Clears Node DEP0104, a pending deprecation, and a latent bug where the restore set the var to the string "undefined" instead of unsetting it.

• test/auth/auth-flow.test.ts

How to test

1. npm run build passes, npm test passes (707), and npx tsc --noEmit is clean
2. npm audit reports 0 vulnerabilities
3. npm test under NODE_OPTIONS=--pending-deprecation no longer emits DEP0104 (the remaining DEP0169 and DEP0144 come from Tailwind v3 and Next internals)
4. npx prisma validate loads prisma.config.ts and the schema is valid

Checklist

• Code works and is readable
• Tested locally
• Commits follow conventional commits
• Assigned reviewers