fix(GRO-563): stabilize OAuth login - upgrade better-auth, fix service worker, add 503 handling

Phase 1 Better Auth stabilization:
- Upgrade better-auth to ^1.5.6 in apps/web (matches api)
- Switch OAuth state to cookie storage (BA v1.5+ requirement)
- Remove manual redirectURI overrides
- Exclude /api/auth/* from service worker caching
- Add 503 error handling when auth not configured
- Display login errors inline on login page
- Update infra submodule with social auth env vars

Closes GRO-563

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/package.json

@@ -15,7 +15,7 @@
   "dependencies": {
     "@groombook/types": "workspace:*",
     "@tailwindcss/vite": "^4.2.2",
-    "better-auth": "^1.0.0",
+    "better-auth": "^1.5.6",
     "lucide-react": "^0.577.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",