feat(web): integrate Better Auth with sign-in/sign-up pages

Web app integration:
- /api/auth/[...all] route exposes Better Auth handler
- src/lib/auth.ts: server helper getServerSession() reading cookies via headers()
- src/lib/auth-client.ts: browser auth client built on shared makeAuthClient
- (auth) route group with sign-in and sign-up pages, both with email+password
  form and "Continua con Google" button (Google flow active when env is set)
- Home page becomes async, shows signed-in user name with sign-out button or
  routes to sign-up/sign-in CTAs
- Italian copy in messages/it.json under Auth.SignIn / Auth.SignUp
- transpilePackages includes @ketopath/auth
- .env.example: BETTER_AUTH_SECRET, BETTER_AUTH_URL, DATABASE_URL, Google placeholders

Build tooling:
- Drop .js extensions from internal package imports so Next webpack can
  transpile them; switch packages/db tsconfig from NodeNext to Bundler
  resolution to keep TS happy (same as packages/auth)

Verified end-to-end via browser:
- /sign-up creates user (Postgres rows in users + accounts), session cookie set,
  redirect to / shows "Accesso effettuato come Mario Test"
- /sign-out clears session, page falls back to anonymous CTAs
- /sign-in with the same credentials restores session

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/.env.example

@@ -1,9 +1,17 @@
 # Next.js
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 
-# Clerk (verrà configurato in uno step dedicato)
-# NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=
-# CLERK_SECRET_KEY=
+# Better Auth (deve coincidere con apps/api/.env)
+# Genera un secret a 32+ byte: `openssl rand -base64 32`
+BETTER_AUTH_SECRET=
+BETTER_AUTH_URL=http://localhost:3000
+
+# Database (Better Auth usa @ketopath/db, che legge DATABASE_URL)
+DATABASE_URL=postgresql://luciano:luciano%40@localhost:5432/ketopath?schema=public
+
+# Google OAuth (configurato a fine progetto)
+# GOOGLE_CLIENT_ID=
+# GOOGLE_CLIENT_SECRET=
 
 # Sentry (verrà configurato in uno step dedicato)
 # NEXT_PUBLIC_SENTRY_DSN=