Add secure customer accounts with sign up and login

You are a senior full-stack security-minded developer working inside my Next.js (App Router), TypeScript, Tailwind and Drizzle project for "Thread & Needle", a fashion e-commerce store selling women's and men's clothing, shoes and accessories to customers in United States. I am not a programmer, so explain technical words briefly.

Goal: add customer accounts with Auth.js (NextAuth version 5) and email plus password login. Read the current official Auth.js documentation first and tell me which pages you used, because setup details change.

Plan first: show me your plan (tables, your recommended password hashing library, argon2 or bcrypt, whichever runs reliably on my computer and the host, how sessions work, protected pages) and wait for my OK before changing anything.

Secrets go in .env.local only, with names (no values) in the committed .env.example. Generate the auth secret with a command that writes it into .env.local without printing it. Never print, log or commit a secret. I will put my admin email in .env.local myself.

Tasks, after I approve:
1. Create a branch named feature/accounts.
2. Database (drizzle-kit migration): users (email lowercase and unique, password hash, name, role customer or admin with customer as default, email verified date, created date), plus an email verification tokens table that stores only a hash of each token, with an expiry.
3. Sign up: a form validated with Zod on both client and server (valid email, password at least 12 characters, a sensible maximum length, matching confirmation). Hash with a strong, slow algorithm and a unique salt. A new user always gets the customer role; visitors cannot choose a role.
4. Login with the Auth.js credentials provider and a signed session in an httpOnly cookie (secure in production, sameSite lax). Use one generic message for a wrong email or password so nobody can learn which emails exist. Add rate limiting on login and sign up, and tell me honestly how well it works on a host with many instances.
5. Logout, and after a successful login call mergeGuestCartIntoUserCart so the guest cart joins the account.
6. Email verification hook: create a function sendVerificationEmail and a verify page that checks the hashed, expiring token. For now it prints the link to the server console in development only; Episode 14 connects Resend. Default: unverified users may browse but must verify before ordering; ask me if I want otherwise.
7. Account page: profile name, change password, an order history area with a friendly empty state and a function getOrdersForUser that Episode 12 will fill in, and a sign out button.
8. Route protection: pages under the account area need a login, and pages under the admin area need the admin role. Check the session in server code for every protected page and action, not only in the framework's route filter. Add a script that promotes the email in my .env.local to admin.
9. Add a forgot-password page that says it arrives in Episode 14. No fake reset.

Security rules:
- Never store, log or return a plain password or a hash.
- Require the current password to change it.
- Protect forms against cross-site request forgery as Auth.js and Next.js recommend, and redirect only to pages on my own site.

Verify by running yourself and showing results: type check, lint, production build, and tests for sign up, duplicate email, weak password, right and wrong login (same message), logout, logged-out visit to the account page (redirect), customer on an admin page (denied), admin on it (allowed), role not settable through sign up, and cart merge after login.

Commit in small steps and open a pull request.

Report back in this format:
1. What you did.
2. What I should check myself.
3. Anything that needs my decision.

Review the prompt, then copy it. Never paste real passwords or API keys into a chat.