feat(auth): add @ketopath/auth package wrapping Better Auth

- New workspace packages/auth exporting:
  - auth: Better Auth server instance using Prisma adapter on @ketopath/db
  - makeAuthClient: React client factory parameterised by baseURL
  - readAuthEnv: Zod-validated env reader (BETTER_AUTH_SECRET min 32 chars,
    BETTER_AUTH_URL, optional GOOGLE_CLIENT_ID/SECRET)
- emailAndPassword enabled with min 8 chars, requireEmailVerification: false
  for MVP (re-enable in V1, see ADR 0001)
- Google provider conditionally registered when both env vars are present —
  keeps the package usable before OAuth configuration is delivered
- 7-day sessions, 24h rolling refresh, cookie prefix 'ketopath'

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/auth/src/server.ts

@@ -0,0 +1,40 @@
+import { prisma } from '@ketopath/db';
+import { betterAuth } from 'better-auth';
+import { prismaAdapter } from 'better-auth/adapters/prisma';
+
+import { readAuthEnv } from './env.js';
+
+const env = readAuthEnv();
+
+const googleProvider =
+  env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET
+    ? {
+        google: {
+          clientId: env.GOOGLE_CLIENT_ID,
+          clientSecret: env.GOOGLE_CLIENT_SECRET,
+        },
+      }
+    : undefined;
+
+export const auth = betterAuth({
+  database: prismaAdapter(prisma, { provider: 'postgresql' }),
+  secret: env.BETTER_AUTH_SECRET,
+  baseURL: env.BETTER_AUTH_URL,
+  emailAndPassword: {
+    enabled: true,
+    // MVP: nessuna verifica email per non bloccare l'onboarding (vedi
+    // docs/decisions/0001-auth-provider.md). Verrà attivata in V1.
+    requireEmailVerification: false,
+    minPasswordLength: 8,
+  },
+  socialProviders: googleProvider,
+  session: {
+    expiresIn: 60 * 60 * 24 * 7, // 7 giorni
+    updateAge: 60 * 60 * 24, // refresh expiresAt ogni 24h se la session è attiva
+  },
+  advanced: {
+    cookiePrefix: 'ketopath',
+  },
+});
+
+export type Auth = typeof auth;