feat(api): add Better Auth plugin and protected GET /me endpoint

- authPlugin runs preHandler that turns Fastify request headers into a Headers
  object, calls auth.api.getSession, and decorates request.user / request.session
- requireAuth() preHandler short-circuits with 401 when not signed in
- New module modules/me with GET /me returning the authenticated user/session
- env validates BETTER_AUTH_SECRET (≥32) and BETTER_AUTH_URL — must match web
- Restored .js extensions in shared packages so NodeNext-resolution consumers
  (api) typecheck cleanly; Next webpack now uses extensionAlias to map .js → .ts
- Re-enabled NodeNext for packages/auth and packages/db tsconfigs

Verified end-to-end:
- POST /api/auth/sign-in/email on web returns session cookie
- GET /me on api with the cookie returns 200 + user/session
- GET /me without the cookie returns 401

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/.env.example

@@ -7,3 +7,11 @@ LOG_LEVEL=info
 CORS_ORIGINS=http://localhost:3000
 
 DATABASE_URL=postgresql://luciano:luciano%40@localhost:5432/ketopath?schema=public
+
+# Better Auth — DEVE coincidere con apps/web/.env (sessione condivisa)
+BETTER_AUTH_SECRET=
+BETTER_AUTH_URL=http://localhost:3000
+
+# Google OAuth (configurato a fine progetto)
+# GOOGLE_CLIENT_ID=
+# GOOGLE_CLIENT_SECRET=