feat: ship phase 1 surface area (v0.2.0)

- primora CLI + @primora/mcp server over generated client
- auth users admin panel, mobile bottom nav
- release workflow: GHCR images, compiled binaries, npm tarballs
- fix gzip Content-Length truncation, nginx upstream re-resolution

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/auth/src/index.ts

@@ -5,7 +5,7 @@ import { requestId } from "hono/request-id";
 import { HTTPException } from "hono/http-exception";
 import { createClient } from "redis";
 
-import { auth, authPool, runAuthMigrations } from "./lib/auth.js";
+import { auth, authPool, promoteAdminEmails, runAuthMigrations } from "./lib/auth.js";
 import { env } from "./lib/env.js";
 
 const redisClient = createClient({
@@ -19,6 +19,7 @@ try {
 }
 
 await retry("auth_migrations", runAuthMigrations);
+await promoteAdminEmails();
 
 const app = new Hono();
 

apps/auth/src/lib/auth.ts

@@ -1,5 +1,5 @@
 import { betterAuth } from "better-auth";
-import { jwt } from "better-auth/plugins";
+import { admin, jwt } from "better-auth/plugins";
 import { getMigrations } from "better-auth/db/migration";
 import { Pool } from "pg";
 
@@ -95,6 +95,7 @@ export const auth = betterAuth({
         },
       },
     }),
+    admin(),
   ],
 });
 
@@ -103,3 +104,13 @@ export async function runAuthMigrations() {
   await migrations.runMigrations();
 }
 
+/** Bootstrap admins by email — run after migrations so the role column exists. */
+export async function promoteAdminEmails() {
+  const emails = (env.AUTH_ADMIN_EMAILS ?? "")
+    .split(",")
+    .map((email) => email.trim().toLowerCase())
+    .filter(Boolean);
+  if (emails.length === 0) return;
+  await authPool.query(`update "user" set role = 'admin' where lower(email) = any($1)`, [emails]);
+}
+

apps/auth/src/lib/env.ts

@@ -27,6 +27,7 @@ const envSchema = z.object({
   MICROSOFT_CLIENT_ID: z.string().optional(),
   MICROSOFT_CLIENT_SECRET: z.string().optional(),
   MICROSOFT_TENANT_ID: z.string().optional(),
+  AUTH_ADMIN_EMAILS: z.string().optional(),
 });
 
 const parsed = envSchema.safeParse(process.env);