feat: Souq native integration + auth simplification + CE-wide enhancements

Souq Marketplace:
- Native souq pages: browse+filters, create listing, detail+seller profile, orders+chat
- New API: reviews (POST), sellers/[id], upload (multipart), polar-checkout webhook
- Listings API enhanced: minPrice, maxPrice, sortBy, deliveryDays filters
- Seller workflow: start order, mark delivered, upload files, confirm delivery
- Wallet: 5 Polar.sh FLH tiers, production checkout, mock fallback, success banner
- Fix: order redirect /souq/history → /souq/orders

Auth System:
- Unified auth page, removed OAuth provider routing (2 files deleted)
- Deleted oauth.ts (319 lines) — simplified auth chain
- Streamlined login/register API routes

Prisma Schema (+179 lines):
- New models: Listing, Purchase, Review, Group/GroupMember
- Gamification: DailyStreak, XpTransaction, Achievement, UserLevel
- Learning: LearnCourse/Module/Enrollment/Certificate
- Notifications, Referrals, Dhikr, PremiumBenefits

Deleted legacy code:
- src/app/api/marketplace/* (3 files) — replaced by /api/souq/*
- src/app/api/files/[listingId]/route.ts — replaced by /api/souq/upload
- src/app/api/seller/[sellerId]/route.ts — replaced by /api/souq/sellers/[id]

Infrastructure:
- Dockerfile: standalone output, Prisma runtime migration
- docker-compose.yml: Polar env vars, healthcheck fix
- docker-compose.staging.yml: staging on port 4014
- .gitea/workflows/ci.yml: CI pipeline

src/app/api/auth/login/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
-import bcrypt from "bcryptjs";
 import { prisma } from "@/lib/prisma";
-import { signJWT } from "@/lib/auth";
+import { UMMAHID_URL } from "@/lib/auth";
 
 export async function POST(req: NextRequest) {
   try {
@@ -14,39 +13,48 @@ export async function POST(req: NextRequest) {
       );
     }
 
-    const user = await prisma.user.findUnique({ where: { email } });
-    if (!user || !user.passwordHash) {
-      return NextResponse.json(
-        { error: "Invalid email or password" },
-        { status: 401 }
-      );
-    }
-
-    const valid = await bcrypt.compare(password, user.passwordHash);
-    if (!valid) {
-      return NextResponse.json(
-        { error: "Invalid email or password" },
-        { status: 401 }
-      );
-    }
-
-    const token = await signJWT({
-      userId: user.id,
-      email: user.email,
-      isPremium: user.isPremium,
-      isPro: user.isPro,
+    // Proxy to Ummah ID
+    const ummahRes = await fetch(`${UMMAHID_URL}/api/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email, password }),
     });
 
+    const ummahData = await ummahRes.json();
+
+    if (!ummahRes.ok) {
+      return NextResponse.json(
+        { error: ummahData.error || "Authentication failed" },
+        { status: ummahRes.status }
+      );
+    }
+
+    const { token, user: ummahUser } = ummahData;
+
+    // Find or create local user by email
+    let localUser = await prisma.user.findUnique({ where: { email } });
+    if (!localUser) {
+      localUser = await prisma.user.create({
+        data: {
+          email,
+          name: ummahUser?.name || email?.split("@")[0] || "User",
+          provider: "ummahid",
+          providerId: ummahUser.id,
+          walletBalance: 5000,
+        },
+      });
+    }
+
     return NextResponse.json({
       token,
       user: {
-        id: user.id,
-        email: user.email,
-        name: user.name,
-        isPremium: user.isPremium,
-        isPro: user.isPro,
-        flhBalance: user.flhBalance,
-        dailyMsgCount: user.dailyMsgCount,
+        id: localUser.id,
+        email: localUser.email,
+        name: localUser.name,
+        isPremium: localUser.isPremium,
+        isPro: localUser.isPro,
+        flhBalance: localUser.flhBalance,
+        dailyMsgCount: localUser.dailyMsgCount,
       },
     });
   } catch (error) {