Migrate authentication to Better Auth

Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie
sessions, validated against the database on every request so revocation,
bans and role changes take effect immediately.

Backend:
- betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and
  the admin plugin; auth-schema.ts maps Better Auth's models onto the
  existing `users` table so user IDs and their foreign keys survive intact.
- routes/auth.ts is gone; Better Auth serves the standard endpoints and
  authExt.ts carries the flows it doesn't cover.
- auth.ts shrinks to session resolution and helpers; sessions/revocation in
  dashboard.ts now read and delete `auth_sessions` rows directly.
- Schema adds the Better Auth core + admin columns (email_verified, image,
  banned, ban_reason, ban_expires), with migrations and tests.
- rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only
  honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES.
- passwordPolicy.ts centralises password validation.
- Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible
  with Better Auth.

Frontend:
- auth-client.ts plus a reworked AuthContext and api/client.ts move to
  cookie-based sessions; no more bearer tokens in requests or middleware.

photo-api:
- Validate Better Auth session cookies against the shared auth_sessions
  table instead of verifying JWTs; JWT_SECRET is no longer needed for user
  auth, and PHOTO_VIEW_SECRET now signs gallery view tokens.

BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the
deprecated JWT_SECRET stays only as the photo-api view-token fallback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/lib/api/photos.ts

@@ -1,4 +1,4 @@
-import { fetchApi, API_BASE, getToken } from './client';
+import { fetchApi, API_BASE } from './client';
 
 // Client for the standalone photo-api Go service (photo-api/), reachable
 // under /api/photos via the Next rewrite (dev) or nginx (prod).
@@ -94,13 +94,13 @@ export const photosApi = {
     }),
 
   uploadPhoto: async (galleryId: string, file: File) => {
-    const token = getToken();
     const formData = new FormData();
     formData.append('files', file);
 
+    // Auth rides on the session cookie (sent same-origin automatically)
     const res = await fetch(`${API_BASE}/api/photos/galleries/${galleryId}/photos`, {
       method: 'POST',
-      headers: token ? { Authorization: `Bearer ${token}` } : {},
+      credentials: API_BASE ? 'include' : 'same-origin',
       body: formData,
     });
     if (!res.ok) {
@@ -122,8 +122,9 @@ export const photosApi = {
     new Promise<{ photos: Photo[] }>((resolve, reject) => {
       const xhr = new XMLHttpRequest();
       xhr.open('POST', `${API_BASE}/api/photos/galleries/${galleryId}/photos`);
-      const token = getToken();
-      if (token) xhr.setRequestHeader('Authorization', `Bearer ${token}`);
+      // Auth rides on the session cookie; XHR sends same-origin cookies by
+      // default, withCredentials is only needed for a cross-origin API_BASE.
+      if (API_BASE) xhr.withCredentials = true;
       xhr.upload.onprogress = (e) => {
         if (e.lengthComputable && e.total > 0) onProgress(e.loaded / e.total);
       };