The authLimiter was blocking legitimate users because Better Auth's
client polls /get-session frequently (on mount, route changes, focus),
and /sign-out was also getting blocked after repeated session polls.
Skip rate limiting for:
- /get-session — read-only, requires valid cookie, no attack surface
- /sign-out — no attack value in blocking logout
- /callback/* — OAuth callbacks from providers
Brute force protection remains on /sign-in, /sign-up, and other
sensitive endpoints.
- Add Express Request type augmentation for req.session
- requireAuth now sets req.session after session validation,
so protected handlers can read the user without calling
getSession again
- Add ConflictError (409) alongside existing AppError subclasses
