fix: improve type safety in NextAuth callbacks (remove any, add explanatory comments)

src/lib/auth.ts

@@ -15,15 +15,20 @@ export const authOptions: NextAuthOptions = {
   callbacks: {
     async jwt({ token, user }) {
       if (user) {
-        token.role = (user as any).role
+        // NextAuth v4 : les types de base n'incluent pas les champs custom.
-        token.id = user.id
+        // Le module augmentation dans next-auth.d.ts couvre le type Session/JWT
+        // mais pas le paramètre `user` du callback jwt. Cast nécessaire.
+        const u = user as typeof user & { role: string }
+        token.role = u.role
+        token.id = u.id
       }
       return token
     },
     async session({ session, token }) {
       if (session.user) {
-        (session.user as any).role = token.role
+        // session.user est déjà augmenté via next-auth.d.ts (id + role)
-        ;(session.user as any).id = token.id
+        session.user.id   = token.id   as string
+        session.user.role = token.role as string
       }
       return session
     },
@@ -38,6 +43,8 @@ export const authOptions: NextAuthOptions = {
       async authorize(credentials, req) {
         if (!credentials?.email || !credentials?.password) return null
 
+        // NextAuth v4 : req est un RequestInternal partiel sans typings complets.
+        // Le cast est nécessaire pour accéder à x-forwarded-for.
         const ip =
           (req as any)?.headers?.['x-forwarded-for']?.split(',')[0]?.trim() ?? 'unknown'
         const key = `${ip}:${credentials.email}`