audit: harden better-auth config, fix types, cleanup

- Fix email verification link using Better Auth's url parameter (was hardcoded to google.com)
- Make App.Locals session/user types nullable to match reality
- Add explicit rate limiting config (60s window, 100 max)
- Add trusted origins for localhost:5173 and production domain
- Add Forgot Password? and Register links to login page
- Remove unused dead code from auth-client.ts
- Remove outdated known-bug note from AGENTS.md (register redirect is fixed)

src/routes/login/+page.svelte

@@ -36,6 +36,14 @@
 			<input type="password" placeholder="Password" bind:value={password} required class="my-2" />
 			<button class="mt-4 rounded bg-blue-200 px-4 py-2" type="submit">Sign In</button>
 		</form>
+		<div class="mt-2 flex flex-col items-center gap-2">
+			<a href="/forgot-password" class="text-sm text-blue-600 hover:text-blue-800"
+				>Forgot Password?</a
+			>
+			<a href="/register" class="text-sm text-blue-600 hover:text-blue-800"
+				>Don't have an account? Register</a
+			>
+		</div>
 		<div class="mt-4 flex flex-col items-center justify-center">
 			<span>Or</span>
 			<button