better-auth in Sonamu

Sonamu owns the schema and the request plumbing; better-auth owns the credential and session logic. Three things have to line up, in this order:

1. pnpm sonamu auth generate writes the entity JSONs.
2. pnpm sonamu migrate generate, then migrate run --execute --confirm, creates the tables.
3. server.auth in sonamu.config.ts turns on the better-auth instance and its routes.

Restricting an endpoint is a separate mechanism: guards and guardHandler enforce nothing auth-specific and work with no auth block at all. They belong to the sonamu-api skill.

auth generate