feat: Better Auth OAuth/OIDC server for the Intervals.icu MCP product

DCR-capable (RFC 7591) OAuth authorization server so Claude's MCP connector
self-registers — the thing Authentik can't do until 2026.8.0. Users sign in with
Google/Apple; oidcProvider + jwt issue asymmetric JWTs (JWKS) the MCP server
verifies. Shares the existing CNPG Postgres (own `betterauth` schema).

Scaffold: auth config, minimal Node server + login page, Dockerfile, CI.

package.json

@@ -0,0 +1,26 @@
+{
+  "name": "intervalsicu-mcp-auth",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "description": "Better Auth OAuth/OIDC server for the Intervals.icu MCP product — Google/Apple sign-in, DCR-capable, issues JWTs the MCP server verifies.",
+  "scripts": {
+    "dev": "tsx watch src/server.ts",
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/server.js",
+    "migrate": "npx @better-auth/cli migrate -y",
+    "generate": "npx @better-auth/cli generate",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "better-auth": "^1.2.9",
+    "pg": "^8.13.1"
+  },
+  "devDependencies": {
+    "@better-auth/cli": "^1.2.9",
+    "@types/node": "^22.10.0",
+    "@types/pg": "^8.11.10",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2"
+  }
+}