Complete Better Auth migration, harden security, update all docs

Console:
- Rewrite auth from JWT decoding to Better Auth useSession()
- Add auth-client.ts with createAuthClient
- Remove elydora_token localStorage, dead auth API functions
- Fix login/register pages to use signIn.email/signUp.email

Server:
- Upgrade better-auth ^1.2.0 → ^1.5.5
- CORS: enforce allowlist on all environments
- Sync auth service and middleware with backend

SDKs:
- Deprecate login/register in Node, Python, Go SDKs
- Update READMEs to show direct token initialization

Config:
- Sanitize .env with dev-only placeholder values
- Update helm chart and install scripts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sdks/go/cmd/elydora/main.go

@@ -69,7 +69,7 @@ func cmdInstall(args []string) {
 	agentID := fs.String("agent-id", "", "Agent ID (required)")
 	privateKey := fs.String("private-key", "", "Base64url-encoded Ed25519 private key seed (required)")
 	kid := fs.String("kid", "", "Key ID (defaults to <agent-id>-key-1)")
-	token := fs.String("token", "", "JWT token for authenticated requests (optional)")
+	token := fs.String("token", "", "API token for authenticated requests (optional)")
 	baseURL := fs.String("base-url", "https://api.elydora.com", "Elydora API base URL")
 
 	fs.Parse(args)