Complete Better Auth migration, harden security, update all docs

Console:
- Rewrite auth from JWT decoding to Better Auth useSession()
- Add auth-client.ts with createAuthClient
- Remove elydora_token localStorage, dead auth API functions
- Fix login/register pages to use signIn.email/signUp.email

Server:
- Upgrade better-auth ^1.2.0 → ^1.5.5
- CORS: enforce allowlist on all environments
- Sync auth service and middleware with backend

SDKs:
- Deprecate login/register in Node, Python, Go SDKs
- Update READMEs to show direct token initialization

Config:
- Sanitize .env with dev-only placeholder values
- Update helm chart and install scripts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sdks/python/elydora/async_client.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import time
 import asyncio
+import warnings
 from typing import Any, Dict, List, Optional, Union
 
 import aiohttp
@@ -50,7 +51,7 @@ class AsyncElydoraClient:
         base_url: API base URL.
         ttl_ms: Time-to-live for operations in milliseconds.
         max_retries: Maximum number of retries on transient failures.
-        token: Optional JWT bearer token for authenticated endpoints.
+        token: Optional bearer token for authenticated endpoints.
     """
 
     def __init__(
@@ -171,7 +172,16 @@ class AsyncElydoraClient:
         display_name: Optional[str] = None,
         org_name: Optional[str] = None,
     ) -> AuthRegisterResponse:
-        """Register a new user and organization."""
+        """Register a new user and organization.
+
+        .. deprecated::
+            Use Better Auth endpoints directly. See docs.
+        """
+        warnings.warn(
+            "AsyncElydoraClient.register() is deprecated. Use Better Auth endpoints directly. See docs.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         url = f"{base_url.rstrip('/')}/v1/auth/register"
         body: Dict[str, Any] = {"email": email, "password": password}
         if display_name is not None:
@@ -186,7 +196,16 @@ class AsyncElydoraClient:
 
     @staticmethod
     async def login(base_url: str, email: str, password: str) -> AuthLoginResponse:
-        """Authenticate and receive a JWT."""
+        """Authenticate and receive a session token.
+
+        .. deprecated::
+            Use Better Auth endpoints directly. See docs.
+        """
+        warnings.warn(
+            "AsyncElydoraClient.login() is deprecated. Use Better Auth endpoints directly. See docs.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         url = f"{base_url.rstrip('/')}/v1/auth/login"
         body = {"email": email, "password": password}
         async with aiohttp.ClientSession() as session:

sdks/python/elydora/cli.py

@@ -172,7 +172,7 @@ def build_parser() -> argparse.ArgumentParser:
     install_parser.add_argument("--agent_id", required=True, help="Agent ID")
     install_parser.add_argument("--private_key", required=True, help="Base64url-encoded Ed25519 private key seed")
     install_parser.add_argument("--kid", required=True, help="Key ID")
-    install_parser.add_argument("--token", default="", help="JWT bearer token (optional)")
+    install_parser.add_argument("--token", default="", help="API bearer token (optional)")
     install_parser.add_argument("--base_url", default="https://api.elydora.com", help="API base URL")
 
     # uninstall

sdks/python/elydora/client.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import time
+import warnings
 from typing import Any, Dict, List, Optional, Union
 
 import requests
@@ -49,7 +50,7 @@ class ElydoraClient:
         base_url: API base URL.
         ttl_ms: Time-to-live for operations in milliseconds.
         max_retries: Maximum number of retries on transient failures.
-        token: Optional JWT bearer token for authenticated endpoints.
+        token: Optional bearer token for authenticated endpoints.
     """
 
     def __init__(
@@ -168,7 +169,16 @@ class ElydoraClient:
         display_name: Optional[str] = None,
         org_name: Optional[str] = None,
     ) -> AuthRegisterResponse:
-        """Register a new user and organization."""
+        """Register a new user and organization.
+
+        .. deprecated::
+            Use Better Auth endpoints directly. See docs.
+        """
+        warnings.warn(
+            "ElydoraClient.register() is deprecated. Use Better Auth endpoints directly. See docs.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         url = f"{base_url.rstrip('/')}/v1/auth/register"
         body: Dict[str, Any] = {"email": email, "password": password}
         if display_name is not None:
@@ -180,7 +190,16 @@ class ElydoraClient:
 
     @staticmethod
     def login(base_url: str, email: str, password: str) -> AuthLoginResponse:
-        """Authenticate and receive a JWT."""
+        """Authenticate and receive a session token.
+
+        .. deprecated::
+            Use Better Auth endpoints directly. See docs.
+        """
+        warnings.warn(
+            "ElydoraClient.login() is deprecated. Use Better Auth endpoints directly. See docs.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         url = f"{base_url.rstrip('/')}/v1/auth/login"
         body = {"email": email, "password": password}
         resp = requests.post(url, json=body, headers={"Content-Type": "application/json"}, timeout=30)