1.1.2 Better-Auth setup with email/password — framework wiring

Estimate: 18m · Depends on: 1.0.2

Install and configure Better-Auth with the email/password method enabled. This subtask wires the framework's plumbing — handler mount, server-side auth helper, session cookies, route-protection middleware — but does NOT yet add Google OAuth (that's 1.1.4), the user/account schema (that's 1.1.3), or the UI screens (that's 1.1.5).

Why Better-Auth, not NextAuth: Better-Auth ships email/password as a first-class primitive (NextAuth treats it as the awkward custom-credentials path) and account-linking semantics are first-class as well, which Subtask 1.1.4 will rely on. OAuth providers are a one-line config-block add — equivalent ergonomics to NextAuth on the OAuth side. Decision recorded in MOTIR.md "Current state".

Why split this from 1.1.3 and 1.1.5: Better-Auth wiring is mostly framework setup with little product surface. It can run in parallel with 1.1.1 (design mockup) and 1.1.3 (user table), shaving a day off the Story's wall-clock time.

What you'll do: pnpm add better-auth, create /lib/auth/index.ts exporting a configured auth instance, mount the handler at /app/api/auth/[...all]/route.ts, configure the session strategy (signed-cookie session — Better-Auth's default for Next.js), add a middleware.ts that protects everything under /app/(authed)/*, and document the new env vars in .env.example. Email/password is enabled but verification is off in this subtask (verification UX lands in 1.1.6 alongside the email abstraction).

Acceptance criteria

• Better-Auth installed; /lib/auth/index.ts exports a configured auth instance with the email/password method enabled.
• Handler mounted at /app/api/auth/[...all]/route.ts; auth.api reachable from server components.
• Cookies are httpOnly + sameSite=lax + secure in production.
• middleware.ts protects routes under /app/(authed)/*; unauthenticated requests redirect to /sign-in.
• Server-side getSession() helper available to server components for reading the current user.
• .env.example updated with: BETTER_AUTH_SECRET, BETTER_AUTH_URL (commented for production scope).
• Smoke test: a placeholder sign-in form (not styled — that's 1.1.5) successfully creates a session cookie and the protected route renders.

Context refs

• README.md — Next.js App Router conventions, env-var pattern
• .env.example — existing env vars to extend
• Better-Auth docs (fetched at prompt-gen time): Next.js integration, email/password method, middleware patterns
• MOTIR.md — Better-Auth decision rationale