feat(api): DB-first auth config loading with env-var fallback (GRO-389)

Refactor auth initialization to support three config states:
1. DB config (auth_provider_config table) — primary source
2. OIDC_* env vars — fallback when DB config absent
3. Unconfigured — graceful handling when neither source available

Changes:
- auth.ts: Add initAuth() async factory, getAuth() getter, getAuthPromise()
- index.ts: Call initAuth() at startup before serve()
- middleware/auth.ts: Use getAuth() instead of direct auth import
- Add auth.test.ts covering all three config states

Preserves AUTH_DISABLED=true behavior and original hairpin NAT pattern.

Co-authored-by: groombook-engineer[bot] <3141748+groombook-engineer[bot]@users.noreply.github.com>
Co-authored-by: Paperclip <noreply@paperclip.ing>

apps/api/src/index.ts

@@ -2,7 +2,7 @@ import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { logger } from "hono/logger";
 import { cors } from "hono/cors";
-import { auth } from "./lib/auth.js";
+import { getAuth, initAuth } from "./lib/auth.js";
 import { clientsRouter } from "./routes/clients.js";
 import { petsRouter } from "./routes/pets.js";
 import { servicesRouter } from "./routes/services.js";
@@ -99,7 +99,7 @@ api.use("*", resolveStaffMiddleware);
 // Better-Auth handler — mounted as sub-app to handle all /api/auth/* routes
 // authMiddleware and resolveStaffMiddleware both skip /api/auth/ paths
 const authRouter = new Hono();
-authRouter.all("/*", (c) => auth.handler(c.req.raw));
+authRouter.all("/*", (c) => getAuth().handler(c.req.raw));
 api.route("/auth", authRouter);
 
 // ── Role guards ────────────────────────────────────────────────────────────────
@@ -168,6 +168,7 @@ api.route("/admin/seed", adminSeedRouter);
 api.route("/search", searchRouter);
 
 const port = Number(process.env.PORT ?? 3000);
+await initAuth();
 console.log(`API server listening on port ${port}`);
 serve({ fetch: app.fetch, port });