feat: Better Auth OAuth/OIDC server for the Intervals.icu MCP product

DCR-capable (RFC 7591) OAuth authorization server so Claude's MCP connector
self-registers — the thing Authentik can't do until 2026.8.0. Users sign in with
Google/Apple; oidcProvider + jwt issue asymmetric JWTs (JWKS) the MCP server
verifies. Shares the existing CNPG Postgres (own `betterauth` schema).

Scaffold: auth config, minimal Node server + login page, Dockerfile, CI.

Dockerfile

@@ -0,0 +1,16 @@
+FROM node:22-alpine
+
+WORKDIR /app
+
+# Install deps (incl. the Better Auth CLI, used by the migration initContainer).
+COPY package.json package-lock.json ./
+RUN npm ci
+
+COPY tsconfig.json ./
+COPY src ./src
+RUN npm run build
+
+ENV NODE_ENV=production
+EXPOSE 8080
+USER node
+CMD ["node", "dist/server.js"]