Complete Better Auth migration, harden security, update all docs

Console:
- Rewrite auth from JWT decoding to Better Auth useSession()
- Add auth-client.ts with createAuthClient
- Remove elydora_token localStorage, dead auth API functions
- Fix login/register pages to use signIn.email/signUp.email

Server:
- Upgrade better-auth ^1.2.0 → ^1.5.5
- CORS: enforce allowlist on all environments
- Sync auth service and middleware with backend

SDKs:
- Deprecate login/register in Node, Python, Go SDKs
- Update READMEs to show direct token initialization

Config:
- Sanitize .env with dev-only placeholder values
- Update helm chart and install scripts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sdks/go/auth.go

@@ -28,6 +28,8 @@ func WithOrgName(name string) RegisterOption {
 }
 
 // Register creates a new user and organization.
+//
+// Deprecated: Use Better Auth endpoints directly. See docs.
 func Register(baseURL, email, password string, opts ...RegisterOption) (*AuthRegisterResponse, error) {
 	if baseURL == "" {
 		baseURL = defaultBaseURL
@@ -49,7 +51,9 @@ func Register(baseURL, email, password string, opts ...RegisterOption) (*AuthReg
 	return &result, nil
 }
 
-// Login authenticates a user and returns a JWT token.
+// Login authenticates a user and returns a session token.
+//
+// Deprecated: Use Better Auth endpoints directly. See docs.
 func Login(baseURL, email, password string) (*AuthLoginResponse, error) {
 	if baseURL == "" {
 		baseURL = defaultBaseURL