Add error handling for database failures in signup/login/profile

None of the database calls in these three places were wrapped in
try/catch, so any database hiccup (disk issue, lock contention, etc.)
surfaced as an unhandled 500 with a useless generic message and no
server-side log to explain why.

Found this while testing every page's redirects end to end: a broken
test setup on my end (an old server process left running against a
deleted database file) produced exactly this failure mode, which
would look identical to a real intermittent outage to an end user.

Now: signup and profile-update return a clear "try again in a
moment" message with the real error logged server-side; login logs
the real error but still shows the existing generic
"incorrect email or password" message to the client (matches
current behavior, avoids leaking account existence).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VL5YUEf2B9LG4xdVUQwcSg

src/app/api/profile/route.ts

@@ -28,6 +28,7 @@ export async function PATCH(request: Request) {
     return NextResponse.json({ error: message }, { status: 400 });
   }
 
+  try {
     const user = await prisma.user.update({
       where: { id: session.user.id },
       data: parsed.data,
@@ -35,4 +36,11 @@ export async function PATCH(request: Request) {
     });
 
     return NextResponse.json({ user });
+  } catch (err) {
+    console.error("profile update failed:", err);
+    return NextResponse.json(
+      { error: "We couldn't save your changes right now. Please try again in a moment." },
+      { status: 503 },
+    );
+  }
 }

src/app/api/signup/route.ts

@@ -26,6 +26,7 @@ export async function POST(request: Request) {
 
   const { name, email, password, age } = parsed.data;
 
+  try {
     const existing = await prisma.user.findUnique({ where: { email } });
     if (existing) {
       return NextResponse.json({ error: "An account with that email already exists" }, { status: 409 });
@@ -39,4 +40,11 @@ export async function POST(request: Request) {
     });
 
     return NextResponse.json({ user }, { status: 201 });
+  } catch (err) {
+    console.error("signup failed:", err);
+    return NextResponse.json(
+      { error: "We couldn't create your account right now. Please try again in a moment." },
+      { status: 503 },
+    );
+  }
 }

src/lib/auth.ts

@@ -18,6 +18,7 @@ export const authOptions: AuthOptions = {
       async authorize(credentials) {
         if (!credentials?.email || !credentials?.password) return null;
 
+        try {
           await ensureDb();
 
           const user = await prisma.user.findUnique({
@@ -29,6 +30,12 @@ export const authOptions: AuthOptions = {
           if (!valid) return null;
 
           return { id: user.id, email: user.email, name: user.name };
+        } catch (err) {
+          // Logged so a database hiccup is visible server-side, even though
+          // the client only ever sees a generic "incorrect email or password".
+          console.error("login authorize() failed:", err);
+          return null;
+        }
       },
     }),
   ],