Migrate authentication to Better Auth

Replace the hand-rolled JWT auth with Better Auth 1.6.25 httpOnly cookie
sessions, validated against the database on every request so revocation,
bans and role changes take effect immediately.

Backend:
- betterAuth.ts wires the Drizzle adapter, magic links, Google sign-in and
  the admin plugin; auth-schema.ts maps Better Auth's models onto the
  existing `users` table so user IDs and their foreign keys survive intact.
- routes/auth.ts is gone; Better Auth serves the standard endpoints and
  authExt.ts carries the flows it doesn't cover.
- auth.ts shrinks to session resolution and helpers; sessions/revocation in
  dashboard.ts now read and delete `auth_sessions` rows directly.
- Schema adds the Better Auth core + admin columns (email_verified, image,
  banned, ban_reason, ban_expires), with migrations and tests.
- rateLimit.ts resolves client IPs spoof-resistantly: proxy headers are only
  honoured from loopback/RFC1918 peers plus TRUSTED_PROXIES.
- passwordPolicy.ts centralises password validation.
- Bump drizzle-orm, drizzle-kit and better-sqlite3 to versions compatible
  with Better Auth.

Frontend:
- auth-client.ts plus a reworked AuthContext and api/client.ts move to
  cookie-based sessions; no more bearer tokens in requests or middleware.

photo-api:
- Validate Better Auth session cookies against the shared auth_sessions
  table instead of verifying JWTs; JWT_SECRET is no longer needed for user
  auth, and PHOTO_VIEW_SECRET now signs gallery view tokens.

BETTER_AUTH_SECRET and BETTER_AUTH_URL are required in production; the
deprecated JWT_SECRET stays only as the photo-api view-token fallback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

photo-api/internal/config/config.go

@@ -15,7 +15,10 @@ type Config struct {
 	Port        int
 	DBType      string // "postgres" | "sqlite", same convention as backend DB_TYPE
 	DatabaseURL string
-	JWTSecret   string
+	// ViewTokenSecret signs the hour-bucketed gallery view tokens
+	// (viewtoken.go). PHOTO_VIEW_SECRET, falling back to the legacy
+	// JWT_SECRET during the Better Auth migration.
+	ViewTokenSecret string
 
 	StoragePath      string
 	S3Endpoint       string
@@ -44,7 +47,7 @@ func Load() (Config, error) {
 		Port:              envInt("PORT", 3003),
 		DBType:            strings.ToLower(env("DB_TYPE", "sqlite")),
 		DatabaseURL:       env("DATABASE_URL", ""),
-		JWTSecret:         env("JWT_SECRET", ""),
+		ViewTokenSecret:   env("PHOTO_VIEW_SECRET", env("JWT_SECRET", "")),
 		StoragePath:       env("STORAGE_PATH", "./data/photos"),
 		S3Endpoint:        env("S3_ENDPOINT", ""),
 		S3Region:          env("S3_REGION", "auto"),
@@ -64,8 +67,8 @@ func Load() (Config, error) {
 	if cfg.DatabaseURL == "" {
 		return cfg, fmt.Errorf("DATABASE_URL is required")
 	}
-	if cfg.JWTSecret == "" {
-		return cfg, fmt.Errorf("JWT_SECRET is required (must match backend/.env)")
+	if cfg.ViewTokenSecret == "" {
+		return cfg, fmt.Errorf("PHOTO_VIEW_SECRET is required (or legacy JWT_SECRET as fallback)")
 	}
 	return cfg, nil
 }