Replace next-auth with Better Auth, migrate DB columns to camelCase

- Replace next-auth v5 beta with better-auth v1.6.2 (stable releases)
- Add multi-provider OAuth support with admin UI configuration
- New oauthProviders table with encrypted secrets (AES-256-GCM)
- Env var bootstrap (OAUTH_*) syncs to DB, UI-created providers fully editable
- OAuth provider REST API: GET/POST/PUT/DELETE /api/v1/oauth-providers
- Settings page "Authentication Providers" section for admin management
- Account linking uses new accounts table (multi-provider per user)
- Username plugin for credentials sign-in (replaces email@localhost pattern)
- bcrypt password compatibility (existing hashes work)
- Database-backed sessions via Kysely adapter (bun:sqlite direct)
- Configurable rate limiting via AUTH_RATE_LIMIT_* env vars
- All DB columns migrated from snake_case to camelCase
- All TypeScript types/models migrated to camelCase properties
- Removed casing: "snake_case" from Drizzle config
- Callback URL format: {baseUrl}/api/auth/oauth2/callback/{providerId}
- package-lock.json removed and gitignored (using bun.lock)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/v1/users/[id]/route.ts

@@ -3,7 +3,7 @@ import { requireApiUser, requireApiAdmin, apiErrorResponse, ApiAuthError } from
 import { getUserById, updateUserProfile, updateUserRole, updateUserStatus, deleteUser } from "@/src/lib/models/user";
 
 function stripPasswordHash(user: Record<string, unknown>) {
-  const { password_hash: _, ...rest } = user;
+  const { passwordHash: _, ...rest } = user;
   void _;
   return rest;
 }
@@ -62,9 +62,9 @@ export async function PUT(
     const profileFields: Record<string, unknown> = {};
     if (body.email !== undefined) profileFields.email = body.email;
     if (body.name !== undefined) profileFields.name = body.name;
-    if (body.avatar_url !== undefined) profileFields.avatar_url = body.avatar_url;
+    if (body.avatarUrl !== undefined) profileFields.avatarUrl = body.avatarUrl;
     if (Object.keys(profileFields).length > 0) {
-      await updateUserProfile(targetId, profileFields as { email?: string; name?: string | null; avatar_url?: string | null });
+      await updateUserProfile(targetId, profileFields as { email?: string; name?: string | null; avatarUrl?: string | null });
     }
 
     const user = await getUserById(targetId);

app/api/v1/users/route.ts

@@ -3,7 +3,7 @@ import { requireApiAdmin, apiErrorResponse } from "@/src/lib/api-auth";
 import { listUsers } from "@/src/lib/models/user";
 
 function stripPasswordHash(user: Record<string, unknown>) {
-  const { password_hash: _, ...rest } = user;
+  const { passwordHash: _, ...rest } = user;
   void _;
   return rest;
 }