audit: harden better-auth config, fix types, cleanup

- Fix email verification link using Better Auth's url parameter (was hardcoded to google.com)
- Make App.Locals session/user types nullable to match reality
- Add explicit rate limiting config (60s window, 100 max)
- Add trusted origins for localhost:5173 and production domain
- Add Forgot Password? and Register links to login page
- Remove unused dead code from auth-client.ts
- Remove outdated known-bug note from AGENTS.md (register redirect is fixed)

src/lib/auth-client.ts

@@ -1,9 +1,3 @@
 import { createAuthClient } from "better-auth/svelte"
 
-export const authClient = createAuthClient({});
-
-const signIn = async () => {
-    const data = await authClient.signIn.social({
-        provider: "google",
-    });
-};
+export const authClient = createAuthClient({});