feat(auth): add request-owned authentication and workspace access

[mateoroldos]

What changed

• add application-owned identities, provider accounts, and workspace membership
• integrate Better Auth behind an API-owned authentication port
• provision identities atomically and safely under concurrent first requests
• scope workspace creation and reads to the authenticated principal
• compose public health and authenticated API groups through dependency-open Effect Layers
• add SSR-aware browser authentication, route guards, forms, and safe return paths
• route each deployed stage through one application host with host-only session cookies
• keep staging and preview deployments out of search indexes

Architecture

HTTP credentials
  → Better Auth adapter
  → RequestAuth middleware
  → IdentityDirectory
  → CurrentPrincipal
  → principal-scoped application services
  → PostgreSQL adapters

Domain and core remain independent of HTTP, SQL, provider SDKs, and Cloudflare. The Worker is the only production composition root.

Validation

• bun run check
• domain and core service tests
• Better Auth adapter tests
• PostgreSQL/PGlite transaction, race, and scoping tests
• scoped production Fetch-router tests
• complete local application HTTP integration tests
• stage-host derivation tests

Deployment verification

After the preview deploys, verify /api/health, signup/session cookies, /api/me, workspace isolation, host-only cookie behavior across stages, and preview noindex metadata.