Replace next-auth with Better Auth, migrate DB columns to camelCase

- Replace next-auth v5 beta with better-auth v1.6.2 (stable releases)
- Add multi-provider OAuth support with admin UI configuration
- New oauthProviders table with encrypted secrets (AES-256-GCM)
- Env var bootstrap (OAUTH_*) syncs to DB, UI-created providers fully editable
- OAuth provider REST API: GET/POST/PUT/DELETE /api/v1/oauth-providers
- Settings page "Authentication Providers" section for admin management
- Account linking uses new accounts table (multi-provider per user)
- Username plugin for credentials sign-in (replaces email@localhost pattern)
- bcrypt password compatibility (existing hashes work)
- Database-backed sessions via Kysely adapter (bun:sqlite direct)
- Configurable rate limiting via AUTH_RATE_LIMIT_* env vars
- All DB columns migrated from snake_case to camelCase
- All TypeScript types/models migrated to camelCase properties
- Removed casing: "snake_case" from Drizzle config
- Callback URL format: {baseUrl}/api/auth/oauth2/callback/{providerId}
- package-lock.json removed and gitignored (using bun.lock)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/unit/api-auth.test.ts

@@ -40,7 +40,7 @@ beforeEach(() => {
 describe('authenticateApiRequest', () => {
   it('authenticates via Bearer token', async () => {
     mockValidateToken.mockResolvedValue({
-      token: { id: 1, name: 'test', created_by: 42, created_at: '', last_used_at: null, expires_at: null },
+      token: { id: 1, name: 'test', createdBy: 42, createdAt: '', lastUsedAt: null, expiresAt: null },
       user: { id: 42, role: 'admin' },
     });
 
@@ -91,7 +91,7 @@ describe('authenticateApiRequest', () => {
 describe('requireApiAdmin', () => {
   it('allows admin users', async () => {
     mockValidateToken.mockResolvedValue({
-      token: { id: 1, name: 'test', created_by: 1, created_at: '', last_used_at: null, expires_at: null },
+      token: { id: 1, name: 'test', createdBy: 1, createdAt: '', lastUsedAt: null, expiresAt: null },
       user: { id: 1, role: 'admin' },
     });
 
@@ -101,7 +101,7 @@ describe('requireApiAdmin', () => {
 
   it('rejects non-admin users with 403', async () => {
     mockValidateToken.mockResolvedValue({
-      token: { id: 1, name: 'test', created_by: 2, created_at: '', last_used_at: null, expires_at: null },
+      token: { id: 1, name: 'test', createdBy: 2, createdAt: '', lastUsedAt: null, expiresAt: null },
       user: { id: 2, role: 'user' },
     });
 
@@ -154,7 +154,7 @@ describe('requireApiUser', () => {
 
   it('CSRF check skips for Bearer-authenticated POST', async () => {
     mockValidateToken.mockResolvedValue({
-      token: { id: 1, name: 'test', created_by: 42, created_at: '', last_used_at: null, expires_at: null },
+      token: { id: 1, name: 'test', createdBy: 42, createdAt: '', lastUsedAt: null, expiresAt: null },
       user: { id: 42, role: 'admin' },
     });