Login end-to-end en Next.js: iron-session + auth SRP6 + página i18n

- lib/session.ts: sesión cifrada httpOnly con iron-session (SESSION_SECRET en
  .env.local). SessionData {bnetId, bnetEmail, username, accountId}.
- lib/auth.ts: authenticate(email,password) verifica contra battlenet_accounts con
  bnetVerify (SRP6 v2); getGameAccounts(bnetId). Resiliente si acore no está.
- app/api/auth/login/route.ts: POST -> autentica, fija sesión, resuelve cuentas de
  juego (1 -> auto; 0/varias -> needsSelection). Devuelve JSON.
- app/[locale]/login: página SSR + LoginForm (cliente, next-intl, router i18n).
  Textos en messages/*.json (namespace Login).
- tsconfig target ES2020 (literales BigInt de bnet.ts).

Validado end-to-end: con una cuenta creada por bnet.py (como haría AzerothCore),
el login TS la verifica OK y emite la cookie de sesión; password incorrecta ->
invalidCredentials; sin campos -> missingFields. Página en ES y EN.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web-next/app/api/auth/login/route.ts

@@ -0,0 +1,42 @@
+import { authenticate, getGameAccounts } from '@/lib/auth'
+import { getSession } from '@/lib/session'
+import { setGameAccountSession } from '@/lib/account-session'
+
+export async function POST(request: Request) {
+  let email = ''
+  let password = ''
+  try {
+    const body = await request.json()
+    email = String(body.email ?? '').trim()
+    password = String(body.password ?? '')
+  } catch {
+    return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 })
+  }
+
+  if (!email || !password) {
+    return Response.json({ success: false, error: 'missingFields' })
+  }
+
+  const account = await authenticate(email, password)
+  if (!account) {
+    return Response.json({ success: false, error: 'invalidCredentials' })
+  }
+
+  const session = await getSession()
+  session.bnetId = account.id
+  session.bnetEmail = account.email
+
+  const games = await getGameAccounts(account.id)
+  let needsSelection = true
+  if (games.length === 1) {
+    setGameAccountSession(session, games[0])
+    needsSelection = false
+  } else {
+    // 0 o >1 cuentas de juego: dejar la selección pendiente
+    delete session.username
+    delete session.accountId
+  }
+  await session.save()
+
+  return Response.json({ success: true, needsSelection })
+}