feat: add OAuth, leaderboard, stats, account linking

[xrvnd]

Closes #39

This PR implements Google OAuth login, cross-device stat syncing, a public leaderboard, and a redesigned Statistics modal: following the interface pattern of games like wafflegame.net as suggested. Tried my best to replicate functionality.

---

Changes

Authentication

• Integrated NextAuth with Google OAuth provider
• New /login page: email input (for previous user) and a "Continue with Google" button
• SessionProvider added to root layout

Database schema

• Split User model into identity (name, email, provider, providerId, countryCode) and a new UserStats model (played, totalStars, currentStreak, bestStreak, starDistribution) : separated as discussed, need review
• upsertGoogleUser checks if a user (google user) already exists using (provider, providerId). If the user exists, it returns the existing user; otherwise, it creates a new one. This prevents duplicate accounts when the same user logs in again. (Running it multiple times does not create duplicates or break anything)

Leaderboard

• New GET /api/leaderboard endpoint returns top 10 authenticated users ordered by totalStars (anonymous users are not included)
• MAX_LEADERBOARD_USERS currently at 10 (as discussed)

Statistics modal

• (Statistics + Leaderboard) tabs in the same page
• Statistics tab- non-scrollable, preserves existing StatBox + StarBar design. This tab shows "Secure your stats with a free account. Log in or Sign up" footer for guests --> shows signed-in name for authenticated users
• Leaderboard tab- scrollable only when entries exceed viewport height, capped at 10 users; ranked by total stars

Menu

• Log In item added at the bottom for guests --> navigates to /login
• Log Out item + user display name shown for authenticated users
• Persistent PLAYER ID footer in all states

---

Test plan

• PUT /api/new-user creates a User row (identity only) + a UserStats row with zero stats
• GET /api/puzzle/status reads stats from UserStats, not User
• Menu --> Log In --> /login page renders with email input and Google button
• Email input + Continue: Google OAuth opens with email pre-filled via login_hint
• Continue with Google: full OAuth flow completes, redirects to /daily
• After login, menu shows user name + Log Out; PLAYER ID still visible
• Log Out --> anonymous mode restored, new localStorage ID on next API call
• GET /api/leaderboard returns only authenticated users, ordered by totalStars desc
• Statistics modal --> Statistics tab: no scroll, "Secure your stats" footer for guests
• Statistics modal --> Leaderboard tab: scrollable list, max 10 entries
• Re-login with same Google account returns the same DB user ID

Looking forward to get my code reviewed

[vercel]

@xrvnd is attempting to deploy a commit to the coderzs' projects Team on Vercel.

A member of the Team first needs to authorize it.