feat: migrate authentication to Better Auth and update profile management logic

AGENTS.md

@@ -33,18 +33,31 @@ packages/api-contract/  # Shared Zod schemas, types, route definitions
 2. Implement handler in `apps/backend`
 3. Consume from `apps/frontend` via workspace import `@repo/api-contract`
 
+## Authentication (Better Auth)
+
+The project uses **Better Auth** for session management, replacing the legacy Supabase Auth.
+
+- **Backend Context**: `AppContext` (mapped via `AppEnv`) provides `c.get('user')` and `c.get('session')`.
+- **User Roles**: The `User` model includes a `role` field (default: `member`). Use `requireSuperAdmin` middleware for protected admin routes.
+- **Session Persistence**: 
+  - Backend: Hono CORS must have `credentials: true`.
+  - Frontend: `authClient` must have `fetchOptions.credentials: 'include'`.
+  - Frontend: Axios instance must have `withCredentials: true`.
+
 ## Key Quirks
 
-- **Prisma 7**: Uses `prisma.config.ts`, requires `DATABASE_URL` env var at generate time
-- **Zod v4**: Use `.issues` instead of `.errors` for validation errors
-- **Generated files**: `routeTree.gen.ts` and `tsconfig*.json` are auto-generated (ignored by Biome)
+- **Prisma 7**: Uses `prisma.config.ts`, requires `DATABASE_URL` env var at generate time.
+- **Gravatar Fallback**: Users without an `image` get an automatic Gravatar Identicon.
+  - Backend: Handled in `user.service.ts` for profile API.
+  - Frontend: Handled in `AuthProvider` (`auth.tsx`) for the session state.
+- **Zod v4**: Use `.issues` instead of `.errors` for validation errors.
 - **TanStack Router**: Routes are code-generated. Use `--filter frontend build` not raw vite build.
 
 ## Docker Deployment (Dokploy)
 
 - **Build Context**: `./` (monorepo root)
 - **Dockerfile**: `Dockerfile` (in root, not `apps/backend/`)
-- **Required args**: `DATABASE_URL`, `VITE_API_BASE_URL`, `VITE_SUPABASE_URL`, `VITE_SUPABASE_ANON_KEY`
+- **Required args**: `DATABASE_URL`, `VITE_API_BASE_URL`, `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`
 - **bun.lock must be tracked**: It's in `.gitignore` by default - remove it for Docker builds
 
 ## Linting
@@ -59,8 +72,9 @@ Biome is used (not ESLint). Config in `biome.json`:
 
 **Backend** (`apps/backend/.env`):
 - `DATABASE_URL` - PostgreSQL connection (required for Prisma)
-- `SUPABASE_URL`, `SUPABASE_ANON_KEY` - Auth
-- `CORS_ORIGIN` - Frontend URL
+- `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL` - Auth core
+- `APP_BASE_URL` - Frontend URL for trusted origins
+- `CORS_ORIGIN` - Frontend URL for CORS policy
 
 **Frontend** (`apps/frontend/.env`):
 - `VITE_*` prefix required (Vite embeds these at build time)