cleanup: remove DEBUG_EMAIL_PASSWORD email/password backdoor; add MIT LICENSE + .env.example

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -49,9 +49,6 @@ Three source files, compiled `src/*.ts` → `dist/*.js` (NodeNext ESM, `.js` imp
 - `pool` — a shared `pg.Pool` from `AUTH_DATABASE_URL`. This is the same CNPG database the rest of
   the product uses; Better Auth's tables (`user`, `session`, `account`, `jwks`, `oauthClient`, ...)
   coexist with the app's own `users` table in the default schema.
-- **`emailAndPassword` is DEBUG-ONLY scaffolding.** Enabled only when `DEBUG_EMAIL_PASSWORD=true`;
-  it exists solely to mint a session headlessly for debugging the OAuth token exchange without a
-  browser. **It must be off in normal operation.**
 
 ### `src/server.ts` — the Node HTTP server
 
@@ -118,7 +115,6 @@ Read from the code:
 | `LOG_LEVEL` | no (`info`) | Better Auth logger level (`debug`/`info`). |
 | `PORT` | no (`8080`) | HTTP listen port. |
 | `PORTAL_CLIENT_ID` / `PORTAL_REDIRECT_URI` | no (have defaults) | Portal OIDC client seeded by `migrate.ts`. |
-| `DEBUG_EMAIL_PASSWORD` | no | **Debug only.** `=true` enables email/password auth for headless debugging. Keep off. |
 
 ## Deployment