Migrate authentication to Better Auth

Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie
sessions, validated against the database on every request so revocation,
bans and role changes take effect immediately.

Backend:
- betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and
  the admin plugin; auth-schema.ts maps Better Auth's models onto the
  existing `users` table so user IDs and their foreign keys survive intact.
- routes/auth.ts is gone; Better Auth serves the standard endpoints and
  authExt.ts carries the flows it doesn't cover.
- auth.ts shrinks to session resolution and helpers; sessions/revocation in
  dashboard.ts now read and delete `auth_sessions` rows directly.
- Schema adds the Better Auth core + admin columns (email_verified, image,
  banned, ban_reason, ban_expires), with migrations and tests.
- rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only
  honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES.
- passwordPolicy.ts centralises password validation.
- Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible
  with Better Auth.

Frontend:
- auth-client.ts plus a reworked AuthContext and api/client.ts move to
  cookie-based sessions; no more bearer tokens in requests or middleware.

photo-api:
- Validate Better Auth session cookies against the shared auth_sessions
  table instead of verifying JWTs; JWT_SECRET is no longer needed for user
  auth, and PHOTO_VIEW_SECRET now signs gallery view tokens.

BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the
deprecated JWT_SECRET stays only as the photo-api view-token fallback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/app/(public)/auth/claim-account/page.tsx

@@ -1,7 +1,7 @@
 'use client';
 
-import { useState, Suspense } from 'react';
-import { useRouter, useSearchParams } from 'next/navigation';
+import { useEffect, useState, Suspense } from 'react';
+import { useRouter } from 'next/navigation';
 import Link from 'next/link';
 import { useLanguage } from '@/context/LanguageContext';
 import { useAuth } from '@/context/AuthContext';
@@ -9,29 +9,48 @@ import Card from '@/components/ui/Card';
 import Button from '@/components/ui/Button';
 import Input from '@/components/ui/Input';
 import { authApi } from '@/lib/api';
+import { authClient } from '@/lib/auth-client';
 import toast from 'react-hot-toast';
 
+/**
+ * Progressive-account claim. The claim email contains a magic link that signs
+ * the user in (via /auth/magic-link) and redirects here; this page then asks
+ * for a password and completes the claim against /api/auth-ext/claim-account.
+ */
 function ClaimAccountContent() {
   const router = useRouter();
-  const searchParams = useSearchParams();
   const { locale: language } = useLanguage();
-  const { setAuthData } = useAuth();
+  const { refreshUser } = useAuth();
   const [loading, setLoading] = useState(false);
+  const [checking, setChecking] = useState(true);
+  const [hasSession, setHasSession] = useState(false);
+  const [alreadyClaimed, setAlreadyClaimed] = useState(false);
   const [formData, setFormData] = useState({
     password: '',
     confirmPassword: '',
   });
 
-  const token = searchParams.get('token');
+  useEffect(() => {
+    let cancelled = false;
+    authClient
+      .getSession()
+      .then(({ data }) => {
+        if (cancelled) return;
+        const user: any = data?.user;
+        setHasSession(!!user);
+        setAlreadyClaimed(!!user && user.isClaimed && user.accountStatus === 'active');
+      })
+      .finally(() => {
+        if (!cancelled) setChecking(false);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
 
   const handleSubmit = async (e: React.FormEvent) => {
     e.preventDefault();
 
-    if (!token) {
-      toast.error(language === 'es' ? 'Token no válido' : 'Invalid token');
-      return;
-    }
-
     if (formData.password !== formData.confirmPassword) {
       toast.error(language === 'es' ? 'Las contraseñas no coinciden' : 'Passwords do not match');
       return;
@@ -49,8 +68,8 @@ function ClaimAccountContent() {
     setLoading(true);
 
     try {
-      const result = await authApi.confirmClaimAccount(token, { password: formData.password });
-      setAuthData({ user: result.user, token: result.token });
+      await authApi.confirmClaimAccount(formData.password);
+      await refreshUser();
       toast.success(language === 'es' ? '¡Cuenta activada!' : 'Account activated!');
       router.push('/dashboard');
     } catch (error: any) {
@@ -60,7 +79,21 @@ function ClaimAccountContent() {
     }
   };
 
-  if (!token) {
+  if (checking) {
+    return (
+      <div className="section-padding min-h-[70vh] flex items-center justify-center">
+        <div className="animate-spin rounded-full h-12 w-12 border-b-2 border-secondary-blue"></div>
+      </div>
+    );
+  }
+
+  if (alreadyClaimed) {
+    // Signed-in and already active: nothing to claim
+    router.push('/dashboard');
+    return null;
+  }
+
+  if (!hasSession) {
     return (
       <div className="section-padding min-h-[70vh] flex items-center">
         <div className="container-page">
@@ -76,8 +109,8 @@ function ClaimAccountContent() {
               </h2>
               <p className="text-gray-600 mb-6">
                 {language === 'es'
-                  ? 'Este enlace de activación no es válido o ha expirado.'
-                  : 'This activation link is invalid or has expired.'}
+                  ? 'Este enlace de activación no es válido o ha expirado. Solicita uno nuevo con "Enlace por Email" en la página de inicio de sesión.'
+                  : 'This activation link is invalid or has expired. Request a new one using "Email Link" on the login page.'}
               </p>
               <Link href="/login">
                 <Button>
@@ -127,7 +160,7 @@ function ClaimAccountContent() {
               <p className="text-xs text-gray-500 -mt-4">
                 {language === 'es' ? 'Mínimo 10 caracteres' : 'Minimum 10 characters'}
               </p>
-              
+
               <Input
                 id="confirmPassword"
                 label={language === 'es' ? 'Confirmar Contraseña' : 'Confirm Password'}
@@ -136,7 +169,7 @@ function ClaimAccountContent() {
                 onChange={(e) => setFormData({ ...formData, confirmPassword: e.target.value })}
                 required
               />
-              
+
               <Button type="submit" className="w-full" size="lg" isLoading={loading}>
                 {language === 'es' ? 'Activar Cuenta' : 'Activate Account'}
               </Button>