audit: harden better-auth config, fix types, cleanup

- Fix email verification link using Better Auth's url parameter (was hardcoded to google.com)
- Make App.Locals session/user types nullable to match reality
- Add explicit rate limiting config (60s window, 100 max)
- Add trusted origins for localhost:5173 and production domain
- Add Forgot Password? and Register links to login page
- Remove unused dead code from auth-client.ts
- Remove outdated known-bug note from AGENTS.md (register redirect is fixed)

src/lib/auth.ts

@@ -11,13 +11,13 @@ export const auth = betterAuth({
 		provider: 'postgresql'
 	}),
 	emailVerification: {
-        sendVerificationEmail: async ({ user }) => {
+		sendVerificationEmail: async ({ user, url }) => {
 			void sendMail({
 				to: user.email,
 				templateId: 'email-verification-email',
 				data: {
 					target_email_address: user.email,
-					verification_link: 'https://google.com'
+					verification_link: url
 				}
 			});
 		}
@@ -43,5 +43,14 @@ export const auth = betterAuth({
 			clientSecret: process.env.GOOGLE_CLIENT_SECRET as string
 		}
 	},
+	rateLimit: {
+		enabled: true,
+		window: 60,
+		max: 100
+	},
+	trustedOrigins: [
+		'http://localhost:5173',
+		'https://portal.rhemawavetech.com'
+	],
 	plugins: [sveltekitCookies(getRequestEvent)]
 });