Build Better Auth per request instead of at module eval

[sarthakagrawal927]

Recovered from the local working tree, where it had been sitting uncommitted.

The bug

betterAuth() was called at module scope:

exportconstauth=betterAuth({secret: authSecret,// read at module evalbaseURL: process.env.BETTER_AUTH_URL,
...
});

OpenNext populates process.env from the Cloudflare request environment, which
happens after Worker module evaluation. So the Worker captured undefined
for the secret, base URL, and Google credentials, leaving auth non-functional in
production while working locally (where the env is present at import time).

The fix

buildAuthOptions(env = process.env) + getAuth() defer construction to the
first request. Callers move off the auth singleton:

• src/app/api/auth/[...all]/route.ts
• src/app/api/checkout/route.ts
• src/lib/auth-utils.ts

Also included

• migrations/0002_better_auth_tables.sql — the D1 tables Better Auth needs
  (user, session, account, verification). Singular names deliberately
  kept separate from the app's existing plural users table.
• src/lib/auth.test.ts — covers the option builder against an injected env,
  which is what made the lazy split testable.
• src/__tests__/user-menu.test.tsx — signed-out menu behaviour.
• Sign-in callbackURL moves / → /dashboard.

🤖 Generated with Claude Code