Better Auth redirects to the login page with the original signed authorize params;
hand them back to /oauth2/authorize as the post-sign-in callback so a code is
issued (was defaulting to '/', producing a blank page).
DCR-capable (RFC 7591) OAuth authorization server so Claude's MCP connector
self-registers — the thing Authentik can't do until 2026.8.0. Users sign in with
Google/Apple; oidcProvider + jwt issue asymmetric JWTs (JWKS) the MCP server
verifies. Shares the existing CNPG Postgres (own `betterauth` schema).
Scaffold: auth config, minimal Node server + login page, Dockerfile, CI.
Chris Farhood