Complete Better Auth migration, harden security, update all docs

Console:
- Rewrite auth from JWT decoding to Better Auth useSession()
- Add auth-client.ts with createAuthClient
- Remove elydora_token localStorage, dead auth API functions
- Fix login/register pages to use signIn.email/signUp.email

Server:
- Upgrade better-auth ^1.2.0 → ^1.5.5
- CORS: enforce allowlist on all environments
- Sync auth service and middleware with backend

SDKs:
- Deprecate login/register in Node, Python, Go SDKs
- Update READMEs to show direct token initialization

Config:
- Sanitize .env with dev-only placeholder values
- Update helm chart and install scripts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sdks/go/client.go

@@ -24,7 +24,7 @@ type Config struct {
 	BaseURL    string // defaults to "https://api.elydora.com"
 	TTLMs      int    // defaults to 30000
 	MaxRetries int    // defaults to 3
-	Token      string // JWT token for authenticated requests
+	Token      string // API token for authenticated requests
 }
 
 // Client is the Elydora SDK client.
@@ -172,7 +172,7 @@ func (c *Client) doPost(path string, body interface{}, result interface{}) error
 	return c.doRequest(http.MethodPost, path, body, result)
 }
 
-// SetToken sets the JWT token used for authenticated API requests.
+// SetToken sets the API token used for authenticated API requests.
 func (c *Client) SetToken(token string) {
 	c.token = token
 }