refactor: align frontend ownership boundaries

Close audit gaps across API drift, query policy, UI, and tests.

src/features/auth/model/auth.tsx

@@ -8,8 +8,7 @@ import {
 	useRef,
 	useState,
 } from "react";
-import { apiClient, configureAuthClient } from "@/shared/api";
-import type { paths } from "@/shared/api/generated/schema";
+import { apiClient, configureAuthClient, type paths } from "@/shared/api";
 
 type User =
 	paths["/api/v1/auth/me"]["get"]["responses"][200]["content"]["application/json"];

src/features/auth/model/validation.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import { validationMessage } from "@/shared/i18n";
+
+function isEmailCharacterInvalid(character: string): boolean {
+	return (
+		/\s/.test(character) ||
+		character.charCodeAt(0) < 32 ||
+		character.charCodeAt(0) === 127
+	);
+}
+
+const email = z
+	.string()
+	.trim()
+	.toLowerCase()
+	.max(254)
+	.refine(
+		(value) =>
+			value.split("@").length === 2 &&
+			value.split("@").every(Boolean) &&
+			!value.split("").some(isEmailCharacterInvalid),
+		validationMessage("auth.validation.invalidEmail"),
+	);
+const password = z
+	.string()
+	.refine(
+		(value) =>
+			new TextEncoder().encode(value).length >= 12 &&
+			new TextEncoder().encode(value).length <= 72,
+		validationMessage("auth.validation.invalidPasswordLength"),
+	);
+
+const loginSchema = z.object({
+	email,
+	password,
+	passwordConfirmation: z.string().optional(),
+});
+const registerSchema = loginSchema.refine(
+	(value) => value.password === value.passwordConfirmation,
+	(value) => ({
+		path: ["passwordConfirmation"],
+		...validationMessage("auth.validation.passwordsDoNotMatch")(value),
+	}),
+);
+
+type AuthFormValues = z.input<typeof loginSchema>;
+
+export { type AuthFormValues, loginSchema, registerSchema };