Migrate to Better-Auth

Migrate to better-auth one phase at a time.

Workflow

1. Audit

Auth library, methods, schema, ORM, seed files.

2. Select features

Auth methods: email/password, OAuth (which providers?), magic link, passkeys, phone/OTP, anonymous
Plugins:      2FA, organization/multi-tenant, admin roles, API keys, SSO/OIDC, JWT, HIBP breach detection
Session:      database-backed (default) | Redis-backed