feat(api): add Better Auth plugin and protected GET /me endpoint

- authPlugin runs preHandler that turns Fastify request headers into a Headers
  object, calls auth.api.getSession, and decorates request.user / request.session
- requireAuth() preHandler short-circuits with 401 when not signed in
- New module modules/me with GET /me returning the authenticated user/session
- env validates BETTER_AUTH_SECRET (≥32) and BETTER_AUTH_URL — must match web
- Restored .js extensions in shared packages so NodeNext-resolution consumers
  (api) typecheck cleanly; Next webpack now uses extensionAlias to map .js → .ts
- Re-enabled NodeNext for packages/auth and packages/db tsconfigs

Verified end-to-end:
- POST /api/auth/sign-in/email on web returns session cookie
- GET /me on api with the cookie returns 200 + user/session
- GET /me without the cookie returns 401

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/auth/src/index.ts

@@ -1,2 +1,2 @@
-export { auth, type Auth } from './server';
-export { readAuthEnv, type AuthEnv } from './env';
+export { auth, type Auth } from './server.js';
+export { readAuthEnv, type AuthEnv } from './env.js';

packages/auth/src/server.ts

@@ -2,7 +2,7 @@ import { prisma } from '@ketopath/db';
 import { betterAuth } from 'better-auth';
 import { prismaAdapter } from 'better-auth/adapters/prisma';
 
-import { readAuthEnv } from './env';
+import { readAuthEnv } from './env.js';
 
 const env = readAuthEnv();
 

packages/auth/tsconfig.json

@@ -1,11 +1,10 @@
 {
-  "extends": "@ketopath/tsconfig/base.json",
+  "extends": "@ketopath/tsconfig/node.json",
   "compilerOptions": {
     "outDir": "dist",
     "rootDir": "src",
     "composite": true,
-    "lib": ["DOM", "ES2022"],
-    "types": ["node"]
+    "lib": ["DOM", "ES2022"]
   },
   "include": ["src/**/*"],
   "exclude": ["node_modules", "dist"]

packages/db/src/index.ts

@@ -1,4 +1,4 @@
-export { prisma } from './client';
+export { prisma } from './client.js';
 export {
   ActivityLevel,
   CookingTime,