[enterprise-auth S11] Mount Better Auth interactive handlers and client integration

[rickylabs]

Part of #871

Complete R2 of seamless-auth-roadmap: mount the upstream Better Auth handler at
a deliberate service path, integrate its client-side plugin requirements into
scaffolds, and reconcile upstream cookie/session semantics with NetScript's
normalized authentication ports. Avoid inventing duplicate sign-in endpoints.

Acceptance

• gate: configured Better Auth endpoints are mounted and reachable under a documented path/base URL
• gate: origin, CSRF, cookie prefix/domain/path/security, proxy, and trusted-origin behavior have production-safe defaults and negative tests
• gate: generated clients include the required client plugins for selected server plugins
• gate: NetScript capability discovery distinguishes upstream-handler operations from normalized port operations
• gate: session lookup, freshness, renewal, revoke, and sign-out ownership are documented and conformance-tested
• gate: multi-backend route/path/cookie collisions fail during configuration rather than at runtime

Metadata

• Dependencies: EA-00; EA-02 for coexistence; EA-09 for plugin-backed profiles.
• Delivery shape: new Better Auth handler adapter and scaffold/client generation.