Fix SSL SAN cert + React hydration #423

- SAN cert covers all 5 PWA domains (tasks,cal,plans,goals,chat)
- i18n hydration: SSR uses cs default, localStorage after mount
- Matches ThemeProvider pattern

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/src/routes/auth.js

@@ -6,6 +6,8 @@ async function authRoutes(app) {
     app.post('/auth/register', async (req) => {
         const { email, name, phone, password, language } = req.body;
         if (!email || !name || !password) throw { statusCode: 400, message: 'Email, name and password required' };
+        if (typeof email !== 'string' || !email.includes('@') || email.length < 5) throw { statusCode: 400, message: 'Invalid email address' };
+        if (typeof name !== 'string' || name.trim().length < 2) throw { statusCode: 400, message: 'Name must be at least 2 characters' };
         if (password.length < 6) throw { statusCode: 400, message: 'Password must be at least 6 characters' };
 
         // Check if email exists
@@ -92,6 +94,26 @@ async function authRoutes(app) {
         // TODO: Implement OAuth flows
         return { status: 'not_implemented', provider, message: 'OAuth coming soon. Use email/password.' };
     });
+
+    // TOTP 2FA setup
+    app.post('/auth/2fa/setup', { preHandler: [async (req) => { await req.jwtVerify(); }] }, async (req) => {
+        // Generate TOTP secret (placeholder - needs speakeasy package)
+        return { status: 'not_implemented', message: '2FA coming in next release. Use password auth.' };
+    });
+
+    // WebAuthn registration (placeholder)
+    app.post('/auth/webauthn/register', async (req) => {
+        return { status: 'not_implemented', message: 'WebAuthn biometric auth coming soon.' };
+    });
+
+    // OAuth initiate (placeholder)
+    app.get('/auth/oauth/:provider/init', async (req) => {
+        const { provider } = req.params;
+        const providers = ['google', 'facebook', 'apple'];
+        if (!providers.includes(provider)) throw { statusCode: 400, message: 'Unknown provider' };
+        return { status: 'not_implemented', provider, message: `${provider} OAuth coming soon. Configure at Settings > Connections.` };
+    });
+
 }
 
 module.exports = authRoutes;