Auth foundation

Auth tables smoke

A live server-side check that the better-auth User and Session tables exist and start empty. Counts come from prisma.user.count() and prisma.session.count() via GET /api/health-auth.