Auth refactor 2/10 — Single-source Better Auth config + split package exports

[pranavp10]

This ticket was generated by AI (to-tickets) from #43.

Parent

#43

What to build

Collapse the two divergent betterAuth() configurations into a single source of truth living in the shared auth package, and restructure that package into clear export paths so server-only runtime dependencies never leak into browser or lightweight consumers. This is the "expand" prefactor: it adds the new structure without any service consuming the new middleware yet.

Acceptance criteria

• Exactly one runtime betterAuth() instance, exposed via @reloop/auth/server
• @reloop/auth/client (browser) and @reloop/auth/types (type-only) export paths exist
• The duplicate type-inference betterAuth() instance is deleted; client types derive from the single source
• The auth service imports its runtime instance from @reloop/auth/server
• Server-only deps (database, Redis, email) are provably absent from the client/types bundles
• Auth service + all frontends build green; the tripwire (Auth refactor 1/10 — Test harness + characterization tripwire #44) still passes

Blocked by

• Auth refactor 1/10 — Test harness + characterization tripwire #44