Migrate authentication to Better Auth

Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie
sessions, validated against the database on every request so revocation,
bans and role changes take effect immediately.

Backend:
- betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and
  the admin plugin; auth-schema.ts maps Better Auth's models onto the
  existing `users` table so user IDs and their foreign keys survive intact.
- routes/auth.ts is gone; Better Auth serves the standard endpoints and
  authExt.ts carries the flows it doesn't cover.
- auth.ts shrinks to session resolution and helpers; sessions/revocation in
  dashboard.ts now read and delete `auth_sessions` rows directly.
- Schema adds the Better Auth core + admin columns (email_verified, image,
  banned, ban_reason, ban_expires), with migrations and tests.
- rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only
  honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES.
- passwordPolicy.ts centralises password validation.
- Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible
  with Better Auth.

Frontend:
- auth-client.ts plus a reworked AuthContext and api/client.ts move to
  cookie-based sessions; no more bearer tokens in requests or middleware.

photo-api:
- Validate Better Auth session cookies against the shared auth_sessions
  table instead of verifying JWTs; JWT_SECRET is no longer needed for user
  auth, and PHOTO_VIEW_SECRET now signs gallery view tokens.

BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the
deprecated JWT_SECRET stays only as the photo-api view-token fallback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/middleware.ts

@@ -3,16 +3,24 @@ import { NextRequest, NextResponse } from 'next/server';
 /**
  * Defense-in-depth guard for authenticated areas.
  *
- * Auth tokens live in localStorage (not readable here), so we rely on a lightweight
- * `spanglish-auth` cookie set alongside login. The API remains the authoritative gate;
- * this only keeps unauthenticated visitors from loading the admin/dashboard JS shell.
+ * Auth is a Better Auth httpOnly session cookie, which IS visible to this
+ * server-side middleware (unlike client JS). The API remains the authoritative
+ * gate — cookie presence is not validated here; this only keeps clearly
+ * unauthenticated visitors from loading the admin/dashboard JS shell.
  */
+const SESSION_COOKIES = [
+  '__Secure-spanglish.session_token', // production (useSecureCookies)
+  'spanglish.session_token', // development
+];
+
 export function middleware(request: NextRequest) {
   const { pathname } = request.nextUrl;
 
   if (pathname.startsWith('/admin') || pathname.startsWith('/dashboard')) {
-    const hasAuthCookie = request.cookies.get('spanglish-auth')?.value === '1';
-    if (!hasAuthCookie) {
+    const hasSessionCookie = SESSION_COOKIES.some(
+      (name) => !!request.cookies.get(name)?.value
+    );
+    if (!hasSessionCookie) {
       const loginUrl = new URL('/login', request.url);
       loginUrl.searchParams.set('redirect', pathname);
       return NextResponse.redirect(loginUrl);