fix: auth handler + circular imports — Phase 1 verification (P1-009)

Refactor BetterAuth integration from NestJS controller to Fastify
onRequest hook to avoid body parser conflicts. Extract injection
tokens to separate files to break circular import cycles.

- Auth handler: use onRequest hook to intercept /api/auth/* before
  Fastify body parser runs, passing raw IncomingMessage to BetterAuth
- Extract AUTH and BRAIN injection tokens to *.tokens.ts files
- Update all controllers to import from tokens files
- Verified: signup, signin, session, CRUD for projects/missions/tasks/
  conversations/messages all functional

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/gateway/src/projects/projects.controller.ts

@@ -13,7 +13,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import type { Brain } from '@mosaic/brain';
-import { BRAIN } from '../brain/brain.module.js';
+import { BRAIN } from '../brain/brain.tokens.js';
 import { AuthGuard } from '../auth/auth.guard.js';
 import { CurrentUser } from '../auth/current-user.decorator.js';
 import type { CreateProjectDto, UpdateProjectDto } from './projects.dto.js';