Complete Better Auth migration, harden security, update all docs

Console:
- Rewrite auth from JWT decoding to Better Auth useSession()
- Add auth-client.ts with createAuthClient
- Remove elydora_token localStorage, dead auth API functions
- Fix login/register pages to use signIn.email/signUp.email

Server:
- Upgrade better-auth ^1.2.0 → ^1.5.5
- CORS: enforce allowlist on all environments
- Sync auth service and middleware with backend

SDKs:
- Deprecate login/register in Node, Python, Go SDKs
- Update READMEs to show direct token initialization

Config:
- Sanitize .env with dev-only placeholder values
- Update helm chart and install scripts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sdks/node/README.md

@@ -15,17 +15,17 @@ Requires Node.js 18+ (uses built-in `crypto` module with Ed25519 support).
 ```typescript
 import { ElydoraClient } from '@elydora/sdk';
 
-// Authenticate
-const auth = await ElydoraClient.login('https://api.elydora.com', 'user@example.com', 'password');
-
-// Create client
+// Initialize the client with your API token.
+// Obtain an API token by signing in via the Elydora console or:
+//   POST /api/auth/sign-in/email  →  get session token
+//   POST /v1/auth/token           →  exchange for long-lived API token
 const client = new ElydoraClient({
-  orgId: auth.user.org_id,
+  orgId: 'org-123',
   agentId: 'my-agent-id',
   privateKey: '<base64url-encoded-32-byte-ed25519-seed>',
   baseUrl: 'https://api.elydora.com',
+  token: 'your-api-token',
 });
-client.setToken(auth.token);
 
 // Create and submit an operation
 const eor = client.createOperation({
@@ -96,7 +96,7 @@ const client = new ElydoraClient({
 // Register a new user and organization
 const reg = await ElydoraClient.register(baseUrl, email, password, displayName?, orgName?);
 
-// Login and receive a JWT
+// Login and receive a session token
 const auth = await ElydoraClient.login(baseUrl, email, password);
 
 // Set token on client

sdks/node/package-lock.json

@@ -1,13 +1,16 @@
 {
   "name": "@elydora/sdk",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@elydora/sdk",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "license": "MIT",
+      "bin": {
+        "elydora": "dist/cli.js"
+      },
       "devDependencies": {
         "@types/node": "^22.0.0",
         "typescript": "^5.7.0"

sdks/node/src/cli.ts

@@ -41,7 +41,7 @@ function printUsage(): void {
   console.log(`Elydora CLI — Tamper-evident audit for AI coding agents
 
 Usage:
-  elydora install   --agent <name> --org_id <id> --agent_id <id> --private_key <key> --kid <kid> [--token <jwt>] [--base_url <url>]
+  elydora install   --agent <name> --org_id <id> --agent_id <id> --private_key <key> --kid <kid> [--token <token>] [--base_url <url>]
   elydora uninstall --agent <name> [--agent_id <id>]
   elydora status
   elydora agents

sdks/node/src/client.ts

@@ -65,7 +65,7 @@ export class ElydoraClient {
   }
 
   /**
-   * Set the JWT token used for authenticated API calls.
+   * Set the session token used for authenticated API calls.
    */
   setToken(token: string): void {
     this.token = token;
@@ -89,6 +89,9 @@ export class ElydoraClient {
   // Auth (static methods — no instance needed)
   // -------------------------------------------------------------------------
 
+  /**
+   * @deprecated Use Better Auth endpoints directly. See docs.
+   */
   static async register(
     baseUrl: string,
     email: string,
@@ -110,6 +113,9 @@ export class ElydoraClient {
     return handleResponse<AuthRegisterResponse>(res);
   }
 
+  /**
+   * @deprecated Use Better Auth endpoints directly. See docs.
+   */
   static async login(
     baseUrl: string,
     email: string,