feat(GRO-1445): provision Better-Auth credential accounts in seed.ts

GRO-1325 was marked done but never implemented. This adds the missing
Better-Auth user + account seeding for UAT email+password logins.

For each SEED_UAT_*_PASSWORD env var present, the seed now:
1. Creates (or links to existing) a Better-Auth user record with
   emailVerified: true
2. Creates a credential account with providerId: "credential"
   and a bcrypt-hashed password (using better-auth/crypto)
3. Links the staff record to the Better-Auth user via userId

Idempotent: skips user/account creation if already seeded.

Updated UAT_PLAYBOOK.md §4.1 — TC-API-1.4 through 1.9 now reference
the new seed provisioning (GRO-1325 was the missing piece).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

packages/db/package.json

@@ -25,6 +25,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "better-auth": "^1.5.6",
     "drizzle-orm": "^0.38.4",
     "postgres": "^3.4.5"
   },