feat(auth): add better-auth core wiring for admin and db

docs/.vitepress/config.mts

@@ -19,6 +19,7 @@ export default defineConfig({
           { text: "Section Overview", link: "/product-engineering/" },
           { text: "Getting Started", link: "/getting-started" },
           { text: "Architecture", link: "/architecture" },
+          { text: "Better Auth Baseline", link: "/product-engineering/auth-baseline" },
           { text: "RBAC And Permissions", link: "/product-engineering/rbac-permission-model" },
           { text: "Workflow", link: "/workflow" },
         ],

docs/getting-started.md

@@ -15,6 +15,7 @@ cp .env.example .env
 ## Database
 
 ```bash
+bun run db:auth:generate
 bun run db:generate
 bun run db:migrate
 bun run db:seed
@@ -28,6 +29,7 @@ bun run dev
 
 - Web: `http://localhost:3000`
 - Admin: `http://localhost:3001`
+- Admin login: `http://localhost:3001/login`
 
 ## Run docs
 

docs/product-engineering/auth-baseline.md

@@ -0,0 +1,33 @@
+# Better Auth Baseline
+
+## Scope
+
+This baseline activates Better Auth for the admin app with email/password login and Prisma-backed sessions.
+
+Implemented in MVP0:
+
+- Shared auth package: `@cms/auth`
+- Admin auth API routes: `apps/admin/src/app/api/auth/[...all]/route.ts`
+- Admin login page: `/login`
+- Prisma auth models (`user`, `session`, `account`, `verification`)
+- Registration toggle via `CMS_ADMIN_REGISTRATION_ENABLED`
+
+## Environment
+
+Required variables:
+
+- `BETTER_AUTH_SECRET`
+- `BETTER_AUTH_URL`
+- `CMS_ADMIN_ORIGIN`
+- `CMS_WEB_ORIGIN`
+- `DATABASE_URL`
+
+Optional:
+
+- `CMS_ADMIN_REGISTRATION_ENABLED`
+- `CMS_DEV_ROLE` (development-only middleware bypass)
+
+## Notes
+
+- Owner bootstrap, hidden support user, and owner invariant are tracked as upcoming MVP0 tasks in `TODO.md`.
+- Email verification and forgot/reset password pipelines are tracked for MVP2.

docs/product-engineering/index.md

@@ -6,6 +6,7 @@ This section covers platform and implementation documentation for engineers and
 
 - [Getting Started](/getting-started)
 - [Architecture](/architecture)
+- [Better Auth Baseline](/product-engineering/auth-baseline)
 - [RBAC And Permissions](/product-engineering/rbac-permission-model)
 - [Workflow](/workflow)