fix(auth): survive a stale session whose user was deleted

A JWT session pointing at a user no longer in the DB (e.g. after a DB reset)
made getUserSettings create settings for a non-existent user -> FK violation
(P2003) -> Server Component render crash. getUserSettings now returns defaults
on P2003; the (app) layout detects the missing user and redirects to a new
server-side /logout route that clears the cookie, avoiding the middleware
redirect loop that otherwise blocks reaching /login.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/data/settings.queries.ts

@@ -1,20 +1,37 @@
+import { Prisma } from "@prisma/client";
 import { prisma } from "@/lib/prisma";
 
+const DEFAULT_SETTINGS = {
+  lowStockThreshold: 20,
+  currency: "EUR",
+  theme: "dark",
+  units: "metric",
+} as const;
+
 export async function getUserSettings(userId: string) {
   let settings = await prisma.userSettings.findUnique({
     where: { userId },
   });
 
   if (!settings) {
-    settings = await prisma.userSettings.create({
-      data: {
-        userId,
-        lowStockThreshold: 20,
-        currency: "EUR",
-        theme: "dark",
-        units: "metric",
-      },
-    });
+    try {
+      settings = await prisma.userSettings.create({
+        data: { userId, ...DEFAULT_SETTINGS },
+      });
+    } catch (err) {
+      // The session's user may no longer exist (e.g. a stale JWT cookie after a
+      // database reset). Creating settings then hits a foreign-key violation
+      // (P2003). Don't crash the Server Component render — return unsaved
+      // defaults. The (app) layout guard redirects such stale sessions to
+      // sign-out, so this fallback is only ever momentarily visible.
+      if (
+        err instanceof Prisma.PrismaClientKnownRequestError &&
+        err.code === "P2003"
+      ) {
+        return { id: "", userId, ...DEFAULT_SETTINGS };
+      }
+      throw err;
+    }
   }
 
   return settings;