fix: pin better-auth 1.6.23, drop stale CLI, programmatic migrations, fix CI

- Explicitly track latest core (1.6.23); the @better-auth/cli lags at 1.4.21 and
  pulled a second core copy — replaced with a getMigrations() script on the same
  version (src/migrate.ts).
- CI build job matches the proven pattern (no setup-buildx; plain build/push).

.gitea/workflows/build.yaml

@@ -19,18 +19,17 @@ jobs:
   build:
     needs: test
     runs-on: ubuntu-latest
-    container:
-      image: catthehacker/ubuntu:act-latest
+    timeout-minutes: 20
     env:
       IMAGE: git.farh.net/farhoodlabs/intervalsicu-mcp-auth
+      DOCKER_BUILDKIT: "1"
     steps:
       - uses: actions/checkout@v4
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
       - name: Login to registry
         run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u cpfarhood --password-stdin
-      - name: Build and push
+      - name: Build image
+        run: docker build --progress=plain -t "${IMAGE}:latest" -t "${IMAGE}:${GITHUB_SHA}" .
+      - name: Push image
         run: |
-          docker build -t "$IMAGE:${GITHUB_SHA}" -t "$IMAGE:latest" .
-          docker push "$IMAGE:${GITHUB_SHA}"
-          docker push "$IMAGE:latest"
+          docker push "${IMAGE}:latest"
+          docker push "${IMAGE}:${GITHUB_SHA}"

package.json

@@ -8,16 +8,14 @@
     "dev": "tsx watch src/server.ts",
     "build": "tsc -p tsconfig.json",
     "start": "node dist/server.js",
-    "migrate": "npx @better-auth/cli migrate -y",
-    "generate": "npx @better-auth/cli generate",
+    "migrate": "node dist/migrate.js",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "better-auth": "^1.2.9",
+    "better-auth": "^1.6.23",
     "pg": "^8.13.1"
   },
   "devDependencies": {
-    "@better-auth/cli": "^1.2.9",
     "@types/node": "^22.10.0",
     "@types/pg": "^8.11.10",
     "tsx": "^4.19.2",

src/migrate.ts

@@ -0,0 +1,22 @@
+/**
+ * Apply Better Auth's schema to the database, using the same core version the
+ * app runs on (no CLI, no version drift). Run as a k8s initContainer, mirroring
+ * the MCP server's Alembic step. Idempotent — a no-op once the schema is current.
+ */
+import { getMigrations } from "better-auth/db/migration";
+import { auth } from "./auth.js";
+
+const { toBeCreated, toBeAdded, runMigrations } = await getMigrations(auth.options);
+
+if (toBeCreated.length === 0 && toBeAdded.length === 0) {
+  console.log("better-auth schema already current; nothing to apply");
+} else {
+  console.log(
+    `applying better-auth schema: ${toBeCreated.length} table(s) to create, ` +
+      `${toBeAdded.length} table(s) to alter`,
+  );
+  await runMigrations();
+  console.log("better-auth schema applied");
+}
+
+process.exit(0);