Replace next-auth with Better Auth, migrate DB columns to camelCase

- Replace next-auth v5 beta with better-auth v1.6.2 (stable releases)
- Add multi-provider OAuth support with admin UI configuration
- New oauthProviders table with encrypted secrets (AES-256-GCM)
- Env var bootstrap (OAUTH_*) syncs to DB, UI-created providers fully editable
- OAuth provider REST API: GET/POST/PUT/DELETE /api/v1/oauth-providers
- Settings page "Authentication Providers" section for admin management
- Account linking uses new accounts table (multi-provider per user)
- Username plugin for credentials sign-in (replaces email@localhost pattern)
- bcrypt password compatibility (existing hashes work)
- Database-backed sessions via Kysely adapter (bun:sqlite direct)
- Configurable rate limiting via AUTH_RATE_LIMIT_* env vars
- All DB columns migrated from snake_case to camelCase
- All TypeScript types/models migrated to camelCase properties
- Removed casing: "snake_case" from Drizzle config
- Callback URL format: {baseUrl}/api/auth/oauth2/callback/{providerId}
- package-lock.json removed and gitignored (using bun.lock)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/(dashboard)/proxy-hosts/ProxyHostsClient.tsx

@@ -133,10 +133,10 @@ export default function ProxyHostsClient({ hosts, certificates, accessLists, caC
       label: "Features",
       render: (host: ProxyHost) => {
         const badges = [
-          host.certificate_id && (
+          host.certificateId && (
             <Badge key="tls" variant="info" className="text-[10px] px-1.5 py-0">TLS</Badge>
           ),
-          host.access_list_id && (
+          host.accessListId && (
             <Badge key="auth" variant="warning" className="text-[10px] px-1.5 py-0">
               <Shield className="h-2.5 w-2.5 mr-0.5" />Auth
             </Badge>
@@ -156,7 +156,7 @@ export default function ProxyHostsClient({ hosts, certificates, accessLists, caC
               <MapPin className="h-2.5 w-2.5 mr-0.5" />Geo
             </Badge>
           ),
-          host.load_balancer?.enabled && (
+          host.loadBalancer?.enabled && (
             <Badge key="lb" variant="secondary" className="text-[10px] px-1.5 py-0">
               <Scale className="h-2.5 w-2.5 mr-0.5" />LB
             </Badge>
@@ -244,7 +244,7 @@ export default function ProxyHostsClient({ hosts, certificates, accessLists, caC
             </p>
             <div className="flex items-center gap-1.5 mt-1">
               <StatusChip status={host.enabled ? "active" : "inactive"} />
-              {host.certificate_id && <Badge variant="info" className="text-[10px] px-1.5 py-0">TLS</Badge>}
+              {host.certificateId && <Badge variant="info" className="text-[10px] px-1.5 py-0">TLS</Badge>}
             </div>
           </div>
           <div className="flex items-center gap-1 shrink-0">