audit: harden better-auth config, fix types, cleanup

- Fix email verification link using Better Auth's url parameter (was hardcoded to google.com)
- Make App.Locals session/user types nullable to match reality
- Add explicit rate limiting config (60s window, 100 max)
- Add trusted origins for localhost:5173 and production domain
- Add Forgot Password? and Register links to login page
- Remove unused dead code from auth-client.ts
- Remove outdated known-bug note from AGENTS.md (register redirect is fixed)

src/app.d.ts

@@ -3,8 +3,8 @@ import type { Session, User } from "better-auth";
 declare global {
 	namespace App {
 		interface Locals {
-			session: Session,
-			user: User,
+			session: Session | null;
+			user: User | null;
 		}
 	}
 }