fix: auth handler + circular imports — Phase 1 verification (P1-009)

Refactor BetterAuth integration from NestJS controller to Fastify
onRequest hook to avoid body parser conflicts. Extract injection
tokens to separate files to break circular import cycles.

- Auth handler: use onRequest hook to intercept /api/auth/* before
  Fastify body parser runs, passing raw IncomingMessage to BetterAuth
- Extract AUTH and BRAIN injection tokens to *.tokens.ts files
- Update all controllers to import from tokens files
- Verified: signup, signin, session, CRUD for projects/missions/tasks/
  conversations/messages all functional

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/gateway/src/auth/auth.module.ts

@@ -2,9 +2,7 @@ import { Global, Module } from '@nestjs/common';
 import { createAuth, type Auth } from '@mosaic/auth';
 import type { Db } from '@mosaic/db';
 import { DB } from '../database/database.module.js';
-import { AuthController } from './auth.controller.js';
-
-export const AUTH = 'AUTH';
+import { AUTH } from './auth.tokens.js';
 
 @Global()
 @Module({
@@ -20,7 +18,6 @@ export const AUTH = 'AUTH';
       inject: [DB],
     },
   ],
-  controllers: [AuthController],
   exports: [AUTH],
 })
 export class AuthModule {}