feat(auth): replace legacy auth with Better Auth

[roundaboutluke]

AI disclaimer: AI-assisted implementation. Still requires full manual review and testing before merge.

This PR replaces Diadem’s existing Discord auth/session implementation with Better Auth.

What changed

• Migrates auth and session handling to Better Auth.
• Reuses Diadem’s existing user and session tables and adds the required Better Auth tables/fields.
• Adds stricter startup checks for auth config and schema readiness.
• Tightens logout behavior and permission fallback handling during Discord/API failures.

Breaking changes

• Existing sessions are invalidated. Users must sign in again after upgrade.
• When server.auth.enabled = true, server.auth.secret, server.auth.baseUrl, and Discord OAuth credentials must be configured or startup will fail. (Included in config/config.example.toml.)
• Existing deployments must update Discord redirect configuration to the Better Auth callback path /api/auth/callback/discord.

DB setup

• New installs: use the existing setup flow:

pnpm run db:push

• Existing databases upgrading from main must run:

mysql -u <user> -p <database> < migrations/001_better_auth.sql