Wire full Better Auth flow with feature flags + callback normalizer

[khanhduyvt0101]

Summary

• Wire magicLink + passkey Better Auth plugins (gated by env, off by default), plus Google + GitHub social providers, end-to-end on server and SPA.
• Introduce a chatacademia-style callback normalizer: dual-storage callback survival across tabs, a new /auth-callback route, and a verify-email view for unverified users.
• Replace isProduction with isLive / isLocal in world-util, add isMagicLinkEnabled / isPasskeyEnabled, and inject them into the SPA bundle via Vite per-key process.env defines.

What changed

Server (@openkitten/world-server)

• auth.tsx: conditional magicLink() + passkey() plugin registration, env-gated socialProviders, defaultCookieAttributes scaled by isLive, ensureAuthCallback validates origin against worldURL before forwarding.
• New passkey table + relations + migration 0002_conscious_maestro.sql (generated via @better-auth/cli generate and drizzle-kit generate).
• New lib/social-providers.ts, lib/emails/magic-link.tsx.

SPA (@openkitten/world-spa)

• auth-callback route + verify-email component cover the new flows.
• lib/{normalize,produce,retrieve,consume}-callback.ts implement dual-storage callback survival with try/catch for Safari private / quota-exceeded.
• lib/{authenticate,get-session,session-query-options}.ts wrap Better Auth UI's session query for clientLoader use.
• auth-provider.tsx reads magicLink={isMagicLinkEnabled} / passkey={isPasskeyEnabled} from world-util; auth-client.ts adds magicLinkClient() + passkeyClient().
• forgot-password.tsx passes redirectTo: ${worldURL}/auth/reset-password so reset emails land on the SPA. sign-up.tsx always routes through /auth-callback. authenticated.tsx layout uses the new authenticate() helper. auth.tsx route falls back to stored callback when no ?redirectTo= query is present.
• vite.config.ts loads .env.local from project root and injects OPENKITTEN_* flags via per-key process.env.X defines.

Util (@openkitten/world-util)

• New is-live.ts, is-local.ts, is-magic-link-enabled.ts, is-passkey-enabled.ts.

Env

• .env.example documents every env var.

Test plan

• bun --bun tsc --build clean
• bun --bun biome check clean
• bun run --workspaces --if-present test — 1517 tests pass across 9 workspaces
• 100% coverage (statements/branches/functions/lines) on every changed package
• Browser-verified /auth/sign-in renders all four methods (email+password, magic-link, passkey, Google, GitHub) with both flags enabled
• Browser-verified flag toggle: setting OPENKITTEN_MAGIC_LINK_ENABLED= and OPENKITTEN_PASSKEY_ENABLED= empty hides their buttons and returns 404 from their endpoints
• Magic-link end-to-end: token stored in Redis after signIn.magicLink API call → visited /auth/magic-link/verify?token=… → server set session cookie → 302 to /auth-callback → consumed stored callback /game → landed on /game
• Passkey endpoints (generate-register-options, generate-authenticate-options, list-user-passkeys) return valid WebAuthn payloads with challenge + rpId
• OAuth: /auth/sign-in/social for both google and github returns provider authorization URL with the dev client_id echoed back

Notes

• Magic-link email send fails with connect ECONNREFUSED 127.0.0.1:587 until SMTP_HOST/USER/PASS are set — the plugin is correctly wired and stores the token in Redis even when the email fails. Production deployments need real SMTP credentials.
• Full passkey enrollment requires a WebAuthn authenticator (hardware or CDP virtual). The endpoints are validated; full ceremony is left to integration testing.
• serverURL and worldURL are localhost ports in dev (same-site). Production with separate hostnames will need crossSubDomainCookies config — out of scope for this PR.

🤖 Generated with Claude Code