fix(#412): wrap BetterAuth handler in try/catch with error logging

Refs #412

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/auth/auth.controller.ts

@@ -1,4 +1,15 @@
-import { Controller, All, Req, Res, Get, UseGuards, Request, Logger } from "@nestjs/common";
+import {
+  Controller,
+  All,
+  Req,
+  Res,
+  Get,
+  UseGuards,
+  Request,
+  Logger,
+  HttpException,
+  HttpStatus,
+} from "@nestjs/common";
 import { Throttle } from "@nestjs/throttler";
 import type { Request as ExpressRequest, Response as ExpressResponse } from "express";
 import type { AuthUser, AuthSession } from "@mosaic/shared";
@@ -105,7 +116,26 @@ export class AuthController {
     this.logger.debug(`Auth catch-all: ${req.method} ${req.url} from ${clientIp}`);
 
     const handler = this.authService.getNodeHandler();
-    return handler(req, res);
+
+    try {
+      await handler(req, res);
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error);
+      const stack = error instanceof Error ? error.stack : undefined;
+
+      this.logger.error(
+        `BetterAuth handler error: ${req.method} ${req.url} from ${clientIp} - ${message}`,
+        stack
+      );
+
+      if (!res.headersSent) {
+        throw new HttpException("Internal auth error", HttpStatus.INTERNAL_SERVER_ERROR);
+      }
+
+      this.logger.warn(
+        `Cannot send error response for ${req.method} ${req.url} - headers already sent`
+      );
+    }
   }
 
   /**