fix: auth handler + circular imports — Phase 1 verification (P1-009)

Refactor BetterAuth integration from NestJS controller to Fastify
onRequest hook to avoid body parser conflicts. Extract injection
tokens to separate files to break circular import cycles.

- Auth handler: use onRequest hook to intercept /api/auth/* before
  Fastify body parser runs, passing raw IncomingMessage to BetterAuth
- Extract AUTH and BRAIN injection tokens to *.tokens.ts files
- Update all controllers to import from tokens files
- Verified: signup, signin, session, CRUD for projects/missions/tasks/
  conversations/messages all functional

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/gateway/src/brain/brain.tokens.ts

@@ -0,0 +1 @@
+export const BRAIN = 'BRAIN';