fix(GRO-563): stabilize OAuth login - upgrade better-auth, fix service worker, add 503 handling

Phase 1 Better Auth stabilization:
- Upgrade better-auth to ^1.5.6 in apps/web (matches api)
- Switch OAuth state to cookie storage (BA v1.5+ requirement)
- Remove manual redirectURI overrides
- Exclude /api/auth/* from service worker caching
- Add 503 error handling when auth not configured
- Display login errors inline on login page
- Update infra submodule with social auth env vars

Closes GRO-563

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/middleware/auth.ts

@@ -23,7 +23,6 @@ if (process.env.AUTH_DISABLED === "true") {
 }
 
 export const authMiddleware: MiddlewareHandler = async (c, next) => {
-  // Better-Auth's own routes handle their own auth (OAuth callbacks, session mgmt)
   if (c.req.path.startsWith("/api/auth/")) {
     await next();
     return;
@@ -37,7 +36,14 @@ export const authMiddleware: MiddlewareHandler = async (c, next) => {
     return;
   }
 
-  const session = await getAuth().api.getSession({
+  let auth;
+  try {
+    auth = getAuth();
+  } catch {
+    return c.json({ error: "Authentication not configured" }, 503);
+  }
+
+  const session = await auth.api.getSession({
     headers: c.req.raw.headers,
   });