fix(GRO-563): stabilize OAuth login - upgrade better-auth, fix service worker, add 503 handling

Phase 1 Better Auth stabilization:
- Upgrade better-auth to ^1.5.6 in apps/web (matches api)
- Switch OAuth state to cookie storage (BA v1.5+ requirement)
- Remove manual redirectURI overrides
- Exclude /api/auth/* from service worker caching
- Add 503 error handling when auth not configured
- Display login errors inline on login page
- Update infra submodule with social auth env vars

Closes GRO-563

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/index.ts

@@ -105,7 +105,13 @@ api.use("*", resolveStaffMiddleware);
 // Better-Auth handler — mounted as sub-app to handle all /api/auth/* routes
 // authMiddleware and resolveStaffMiddleware both skip /api/auth/ paths
 const authRouter = new Hono();
-authRouter.all("/*", (c) => getAuth().handler(c.req.raw));
+authRouter.all("/*", (c) => {
+  try {
+    return getAuth().handler(c.req.raw);
+  } catch {
+    return c.json({ error: "Authentication not configured" }, 503);
+  }
+});
 api.route("/auth", authRouter);
 
 // ── Role guards ────────────────────────────────────────────────────────────────