feat(api): seed a dev login account (worker@solelog.local) for testing

db:seed now also creates a ready-made dev account via better-auth (properly
hashed), idempotent, and SKIPPED when NODE_ENV=production so no known-password
account ships to prod. Credentials: worker@solelog.local / werkplaats123.
Documented in the worker README. API tests 37/37 green; verified live (sign-in
returns a bearer token; /api/me returns the user).

apps/api/src/db/seed.ts

@@ -1,7 +1,13 @@
 import { pathToFileURL } from 'node:url';
 import { eq } from 'drizzle-orm';
 import { db } from './client';
-import { activities } from './schema';
+import { activities, user } from './schema';
+import { auth } from '../auth';
+
+// Dev-only test account so `db:seed` yields ready-made login credentials for local
+// testing / phone demos. Created through better-auth (password is properly hashed).
+// NEVER seeded when NODE_ENV=production — see seedDevUser().
+const DEV_USER = { email: 'worker@solelog.local', password: 'werkplaats123', name: 'Test Werker' };
 
 // Reference activities (realistic Dutch handeling names) — see
 // docs/reference/legacy-mobile-app.md §6.2 and the Phase 1 plan.
@@ -14,6 +20,17 @@ const REFERENCE_ACTIVITIES: { name: string; insoleTypes: string[] }[] = [
   { name: 'Printen', insoleTypes: ['3D'] },
 ];
 
+// Idempotent: create the dev account once, and only outside production (it has a
+// known password). Uses better-auth's server API so the user + hashed-password
+// account rows are created exactly as a real sign-up would.
+async function seedDevUser(): Promise<void> {
+  if (process.env.NODE_ENV === 'production') return;
+  const existing = await db.select().from(user).where(eq(user.email, DEV_USER.email));
+  if (existing.length > 0) return;
+  await auth.api.signUpEmail({ body: DEV_USER });
+  console.log(`Seeded dev account: ${DEV_USER.email} / ${DEV_USER.password}`);
+}
+
 // Idempotent: insert each reference activity only if no activity with that name exists.
 export async function seed(): Promise<void> {
   for (const activity of REFERENCE_ACTIVITIES) {
@@ -28,6 +45,7 @@ export async function seed(): Promise<void> {
       });
     }
   }
+  await seedDevUser();
 }
 
 // Allow running directly: `tsx src/db/seed.ts` (cross-platform — pathToFileURL