feat(api): integrate Better Auth with Drizzle adapter and social providers

- Add Better Auth config with Google + GitHub social providers
- Mount auth handler on /api/auth/* in Express
- Generate and migrate auth tables (user, session, account, verification)
- Deduplicate term_glosses data for tighter unique constraint
- Drop legacy users table

apps/api/package.json

@@ -12,6 +12,7 @@
   "dependencies": {
     "@glossa/db": "workspace:*",
     "@glossa/shared": "workspace:*",
+    "better-auth": "^1.6.2",
     "express": "^5.2.1"
   },
   "devDependencies": {

apps/api/src/app.ts

@@ -1,11 +1,14 @@
 import express from "express";
 import type { Express } from "express";
+import { toNodeHandler } from "better-auth/node";
+import { auth } from "./lib/auth.js";
 import { apiRouter } from "./routes/apiRouter.js";
 import { errorHandler } from "./middleware/errorHandler.js";
 
 export function createApp() {
   const app: Express = express();
 
+  app.all("/api/auth/*splat", toNodeHandler(auth));
   app.use(express.json());
   app.use("/api/v1", apiRouter);
   app.use(errorHandler);

apps/api/src/lib/auth.ts

@@ -0,0 +1,17 @@
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { db } from "@glossa/db";
+
+export const auth = betterAuth({
+  database: drizzleAdapter(db, { provider: "pg" }),
+  socialProviders: {
+    google: {
+      clientId: process.env["GOOGLE_CLIENT_ID"] as string,
+      clientSecret: process.env["GOOGLE_CLIENT_SECRET"] as string,
+    },
+    github: {
+      clientId: process.env["GITHUB_CLIENT_ID"] as string,
+      clientSecret: process.env["GITHUB_CLIENT_SECRET"] as string,
+    },
+  },
+});

apps/web/package.json

@@ -13,6 +13,7 @@
     "@tailwindcss/vite": "^4.2.2",
     "@tanstack/react-router": "^1.168.1",
     "@tanstack/react-router-devtools": "^1.166.10",
+    "better-auth": "^1.6.2",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "tailwindcss": "^4.2.2"