Fix Mastra auth flow and Better Auth base URL

[teallarson]

Summary

• Mastra OAuth broken: The connect route was using mcpClient.listTools() (Mastra's MCPClient) to trigger OAuth, but Mastra tries both Streamable HTTP and SSE transports before calling redirectToAuthorization — unreliably saving client registration and PKCE verifier. The callback's auth() call then had no state to work with, so tokens were never stored. Plan route got 401 "Missing Authorization header".
  • Fix: added initiateOAuth() to Mastra's arcade.ts (mirrors ai-sdk template) and rewrote doConnect() / verifyExistingConnection() in the connect route to use it
• Better Auth sign-in failing without ngrok: betterAuth() had no baseURL, so it couldn't determine the base URL for callbacks/redirects, causing "Network error" on sign-in
  • Fix: set baseURL from NEXT_PUBLIC_APP_URL with http://localhost:<PORT> fallback
• Plan route error UX: raw MCPClientError message was shown to users on auth failure
  • Fix: detect 401/auth errors in the catch block and show a human-readable message

Test plan

• Run Mastra template locally (no ngrok): sign in works, no Better Auth warning
• Run Mastra template, connect Arcade without tokens cached: OAuth flow completes, plan route works after callback
• Run Mastra template with expired/missing tokens: plan route shows "Not connected to Arcade" instead of raw error

🤖 Generated with Claude Code