Replace next-auth with Better Auth, migrate DB columns to camelCase

- Replace next-auth v5 beta with better-auth v1.6.2 (stable releases)
- Add multi-provider OAuth support with admin UI configuration
- New oauthProviders table with encrypted secrets (AES-256-GCM)
- Env var bootstrap (OAUTH_*) syncs to DB, UI-created providers fully editable
- OAuth provider REST API: GET/POST/PUT/DELETE /api/v1/oauth-providers
- Settings page "Authentication Providers" section for admin management
- Account linking uses new accounts table (multi-provider per user)
- Username plugin for credentials sign-in (replaces email@localhost pattern)
- bcrypt password compatibility (existing hashes work)
- Database-backed sessions via Kysely adapter (bun:sqlite direct)
- Configurable rate limiting via AUTH_RATE_LIMIT_* env vars
- All DB columns migrated from snake_case to camelCase
- All TypeScript types/models migrated to camelCase properties
- Removed casing: "snake_case" from Drizzle config
- Callback URL format: {baseUrl}/api/auth/oauth2/callback/{providerId}
- package-lock.json removed and gitignored (using bun.lock)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

proxy.ts

@@ -1,6 +1,7 @@
-import { auth } from "@/src/lib/auth";
 import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
 import crypto from "node:crypto";
+import { auth } from "@/src/lib/auth";
 
 /**
  * Next.js Proxy for route protection.
@@ -34,8 +35,7 @@ function buildCsp(nonce: string): string {
   return directives.join("; ");
 }
 
-export default auth((req) => {
-  const isAuthenticated = !!req.auth;
+export default async function middleware(req: NextRequest) {
   const pathname = req.nextUrl.pathname;
 
   // Allow public routes
@@ -51,6 +51,10 @@ export default auth((req) => {
     return NextResponse.next();
   }
 
+  // Check authentication for protected routes
+  const session = await auth(req);
+  const isAuthenticated = !!session?.user;
+
   // Redirect unauthenticated users to login
   if (!isAuthenticated && !pathname.startsWith("/login")) {
     const loginUrl = new URL("/login", req.url);
@@ -77,7 +81,7 @@ export default auth((req) => {
   response.headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), interest-cohort=()");
 
   return response;
-});
+}
 
 export const config = {
   matcher: [