dev: Second exploration of better-auth client

[isTravis]

• Replace ~460 lines of custom OIDC code (PKCE, token exchange, session cookies) with better-auth's genericOAuth plugin

  • Adopt better-auth's organization and apiKey plugins, replacing custom org/member/invitation/API-key tables and ~900 lines of CRUD handlers
  • Split the old accounts table into better-auth-managed user/session/organization/member/invitation/apikey tables
  • Frontend API key pages now use authClient.apiKey.* methods; scope is passed via metadata and translated to permissions server-side via
    defaultPermissions
  • Add startup health check against KF Auth (/api/health) to fail fast if the auth provider is unreachable
  • Fix Vite HMR in Docker by sharing the HTTP server between Hono and Vite (no extra port needed)
  • Fix HTML pattern regex attributes for browsers using the /v flag

  Deleted files

  • src/lib/oidc.server.ts — custom OIDC discovery + token exchange
  • src/api/kf-auth.ts — custom login/callback/logout routes
  • src/lib/kf-auth.server.ts, kf-orgs.server.ts, kf-profile-cache.server.ts — shims