Implement PocketBase auth helpers (P0.1)

Add authentication utilities to pocketbase.ts for server-side auth:
- createPocketBaseClient() - factory for fresh instances per request
- isAuthenticated(pb) - checks authStore validity
- getCurrentUser(pb) - returns typed User from authStore
- loadAuthFromCookies(pb, cookies) - loads auth from Next.js cookies

Includes 9 unit tests covering all auth state scenarios and cookie loading.
This unblocks P0.2 (auth middleware) and all downstream API/page work.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

IMPLEMENTATION_PLAN.md

@@ -14,7 +14,7 @@ This file is maintained by Ralph. Run `./ralph-sandbox.sh plan 3` to generate ta
 | `encryption.ts` | **Complete** | AES-256-GCM encrypt/decrypt implemented. **MISSING: tests** |
 | `decision-engine.ts` | **COMPLETE** | 8 priority rules + override handling with `getDecisionWithOverrides()`, 24 tests |
 | `garmin.ts` | **Minimal (~30%)** | Has fetchGarminData, isTokenExpired, daysUntilExpiry. **MISSING: fetchHrvStatus, fetchBodyBattery, fetchIntensityMinutes** |
-| `pocketbase.ts` | **Basic** | Has pb client only. **MISSING: getCurrentUser(), isAuthenticated(), loadAuthFromCookies()** |
+| `pocketbase.ts` | **COMPLETE** | 9 tests covering `createPocketBaseClient()`, `isAuthenticated()`, `getCurrentUser()`, `loadAuthFromCookies()` |
 
 ### Missing Infrastructure Files (CONFIRMED NOT EXIST)
 - `src/lib/auth-middleware.ts` - Does NOT exist, needs creation
@@ -65,12 +65,12 @@ This file is maintained by Ralph. Run `./ralph-sandbox.sh plan 3` to generate ta
 |-----------|--------|
 | `src/lib/cycle.test.ts` | **EXISTS** - 9 tests |
 | `src/lib/decision-engine.test.ts` | **EXISTS** - 24 tests (8 algorithmic rules + 16 override scenarios) |
+| `src/lib/pocketbase.test.ts` | **EXISTS** - 9 tests (auth helpers, cookie loading) |
 | `src/lib/nutrition.test.ts` | **MISSING** |
 | `src/lib/email.test.ts` | **MISSING** |
 | `src/lib/ics.test.ts` | **MISSING** |
 | `src/lib/encryption.test.ts` | **MISSING** |
 | `src/lib/garmin.test.ts` | **MISSING** |
-| `src/lib/pocketbase.test.ts` | **MISSING** |
 | API route tests | **NONE** |
 | E2E tests | **NONE** |
 
@@ -87,12 +87,12 @@ This file is maintained by Ralph. Run `./ralph-sandbox.sh plan 3` to generate ta
 
 These must be completed first - nothing else works without them.
 
-### P0.1: PocketBase Auth Helpers
-- [ ] Add authentication utilities to pocketbase.ts
+### P0.1: PocketBase Auth Helpers ✅ COMPLETE
+- [x] Add authentication utilities to pocketbase.ts
 - **Files:**
-  - `src/lib/pocketbase.ts` - Add `getCurrentUser()`, `isAuthenticated()`, `loadAuthFromCookies()`
+  - `src/lib/pocketbase.ts` - Added `createPocketBaseClient()`, `getCurrentUser()`, `isAuthenticated()`, `loadAuthFromCookies()`
 - **Tests:**
-  - `src/lib/pocketbase.test.ts` - Test auth state management, cookie loading
+  - `src/lib/pocketbase.test.ts` - 9 tests covering auth state management, cookie loading
 - **Why:** Every protected route and page depends on these helpers
 - **Blocking:** P0.2, P0.4, P1.1-P1.7, P2.2-P2.13
 
@@ -462,6 +462,7 @@ P2.14 Mini calendar
 ### Library
 - [x] **cycle.ts** - Complete with 9 tests (`getCycleDay`, `getPhase`, `getPhaseConfig`, `getPhaseLimit`)
 - [x] **decision-engine.ts** - Complete with 24 tests (`getTrainingDecision` + `getDecisionWithOverrides`)
+- [x] **pocketbase.ts** - Complete with 9 tests (`createPocketBaseClient`, `isAuthenticated`, `getCurrentUser`, `loadAuthFromCookies`)
 
 ### Components
 - [x] **DecisionCard** - Displays decision status, icon, and reason
@@ -479,7 +480,7 @@ P2.14 Mini calendar
 - [ ] `src/lib/auth-middleware.ts` does not exist - must be created in P0.2
 - [ ] `src/app/middleware.ts` does not exist - must be created in P0.2
 - [ ] `garmin.ts` is only ~30% complete - missing specific biometric fetchers
-- [ ] `pocketbase.ts` missing all auth helper functions
+- [x] ~~`pocketbase.ts` missing all auth helper functions~~ - FIXED in P0.1
 
 ---