fix(api): mount Next.js frontend as default app and prefix all API routes under /api

feat(auth): implement production authentication flow and Next.js login page