Aldoc Auth

Better Auth's identity service. Routes live under /api/auth/* — see apps/backend/docs/ADR-007-better-auth-topology.md.