Complete Better Auth migration, harden security, update all docs

Console:
- Rewrite auth from JWT decoding to Better Auth useSession()
- Add auth-client.ts with createAuthClient
- Remove elydora_token localStorage, dead auth API functions
- Fix login/register pages to use signIn.email/signUp.email

Server:
- Upgrade better-auth ^1.2.0 → ^1.5.5
- CORS: enforce allowlist on all environments
- Sync auth service and middleware with backend

SDKs:
- Deprecate login/register in Node, Python, Go SDKs
- Update READMEs to show direct token initialization

Config:
- Sanitize .env with dev-only placeholder values
- Update helm chart and install scripts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

helm/elydora/templates/secret.yaml

@@ -8,7 +8,7 @@ metadata:
 type: Opaque
 stringData:
   DATABASE_URL: {{ include "elydora.databaseUrl" . | quote }}
-  JWT_SECRET: {{ .Values.api.jwtSecret | quote }}
+  BETTER_AUTH_SECRET: {{ .Values.api.betterAuthSecret | quote }}
   ELYDORA_SIGNING_KEY: {{ .Values.api.signingKey | quote }}
   POSTGRES_PASSWORD: {{ .Values.postgres.password | quote }}
   MINIO_SECRET_KEY: {{ .Values.minio.rootPassword | quote }}

helm/elydora/values.yaml

@@ -77,7 +77,7 @@ minio:
 api:
   port: 8787
   environment: production
-  jwtSecret: change-me-to-a-random-string-at-least-32-chars
+  betterAuthSecret: change-me-to-a-random-string-at-least-32-chars
   signingKey: change-me-base64url-ed25519-private-key
   allowedOrigins: "https://console.example.com"
   tsaUrl: "http://timestamp.sectigo.com"