fix(#410): align BetterAuth basePath and auth client with NestJS routing

BetterAuth defaulted basePath to /api/auth but NestJS controller routes
to /auth/* (no global prefix). The auth client also pointed at the web
frontend origin instead of the API server, and LoginButton used a
nonexistent GET /auth/signin/authentik endpoint.

- Set basePath: "/auth" in BetterAuth server config
- Point auth client baseURL to API_BASE_URL with matching basePath
- Add genericOAuthClient plugin to auth client
- Use signIn.oauth2({ providerId: "authentik" }) in LoginButton

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/auth/auth.config.ts

@@ -83,6 +83,7 @@ export function createAuth(prisma: PrismaClient) {
   validateOidcConfig();
 
   return betterAuth({
+    basePath: "/auth",
     database: prismaAdapter(prisma, {
       provider: "postgresql",
     }),