fix(auth): restore unconditional Better-Auth fallback, add unknown-path test

Remove startsWith('/auth') guard that caused non-auth paths to hang with
no response. Better-Auth already handles /health and /auth/health are
explicitly short-circuited before the handler. Add test asserting unknown
paths receive a terminal response within 1s.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

auth/src/__tests__/health.test.ts

@@ -97,4 +97,21 @@ describe('Auth health endpoint', () => {
     equal(status, 503);
     equal(body, '{"status":"error","db":"unreachable"}');
   });
+
+  it('returns a terminal response for unknown paths (no hang)', async () => {
+    const poolMock = { connect: async () => ({ query: async () => {}, release: () => {} }) };
+    const { port, close } = await startHealthServer(poolMock);
+
+    const result = await new Promise<{ status: number }>((resolve) => {
+      const req = http.get(`http://localhost:${port}/`, (res) => {
+        res.resume();
+        res.on('end', () => resolve({ status: res.statusCode ?? 0 }));
+      });
+      req.on('error', () => resolve({ status: 0 }));
+      setTimeout(() => resolve({ status: -1 }), 1000);
+    });
+    close();
+
+    equal(result.status !== -1, true, 'Unknown path must return a terminal response within 1s');
+  });
 });

auth/src/index.ts

@@ -28,11 +28,8 @@ const server = createServer(async (req, res) => {
     return;
   }
 
-  // All /auth/* routes handled by Better-Auth
-  if (req.url?.startsWith("/auth")) {
-    await handler(req, res);
-    return;
-  }
+  // All other routes handled by Better-Auth (returns 404 for unknown paths)
+  await handler(req, res);
 });
 
 server.listen(port, "0.0.0.0", () => {