Replace next-auth with Better Auth, migrate DB columns to camelCase

- Replace next-auth v5 beta with better-auth v1.6.2 (stable releases)
- Add multi-provider OAuth support with admin UI configuration
- New oauthProviders table with encrypted secrets (AES-256-GCM)
- Env var bootstrap (OAUTH_*) syncs to DB, UI-created providers fully editable
- OAuth provider REST API: GET/POST/PUT/DELETE /api/v1/oauth-providers
- Settings page "Authentication Providers" section for admin management
- Account linking uses new accounts table (multi-provider per user)
- Username plugin for credentials sign-in (replaces email@localhost pattern)
- bcrypt password compatibility (existing hashes work)
- Database-backed sessions via Kysely adapter (bun:sqlite direct)
- Configurable rate limiting via AUTH_RATE_LIMIT_* env vars
- All DB columns migrated from snake_case to camelCase
- All TypeScript types/models migrated to camelCase properties
- Removed casing: "snake_case" from Drizzle config
- Callback URL format: {baseUrl}/api/auth/oauth2/callback/{providerId}
- package-lock.json removed and gitignored (using bun.lock)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/user/change-password/route.ts

@@ -60,7 +60,7 @@ export async function POST(request: NextRequest) {
     }
 
     // If user has a password, verify current password
-    if (user.password_hash) {
+    if (user.passwordHash) {
       if (!currentPassword) {
         return NextResponse.json(
           { error: "Current password is required" },
@@ -68,7 +68,7 @@ export async function POST(request: NextRequest) {
         );
       }
 
-      const isValid = bcrypt.compareSync(currentPassword, user.password_hash);
+      const isValid = bcrypt.compareSync(currentPassword, user.passwordHash);
       if (!isValid) {
         registerFailedAttempt(rateLimitKey);
         return NextResponse.json(
@@ -90,10 +90,10 @@ export async function POST(request: NextRequest) {
     // Audit log
     await createAuditEvent({
       userId,
-      action: user.password_hash ? "password_changed" : "password_set",
+      action: user.passwordHash ? "password_changed" : "password_set",
       entityType: "user",
       entityId: userId,
-      summary: user.password_hash ? "User changed their password" : "User set a password",
+      summary: user.passwordHash ? "User changed their password" : "User set a password",
     });
 
     return NextResponse.json({