Refactor/better auth

[lebalz]

Better Auth

Caution

Breaking Changes

This PR migrates to use better auth for authentication and basic user management.

This needed some changes on the infrastructure

• using ESM instead of CommonJS. This has the following side effects:
  • upgrading to express v5
  • using at least node v22.15.0
• migrating database
  • user roles are now managed by better-auth - it is now a string instead of an enum
  • better-auth related new db tables
• refactoring of socketio notifications
  • using a singleton to init and expose socketio server instance, s.t. better auth hooks can access it too

Benefits

• multiple auth methods (Microsoft, Github, Username-Password)
• state-of-the-art implementation
• options to easily add stuff like 2FA or magic email links or whatever...

Upgrade

To upgrade, make sure to

1. backup your prod db.
2. add env var BETTER_AUTH_SECRET (see https://www.better-auth.com/docs/installation)
3. add env var BETTER_AUTH_URL pointing to your backend api url, e.g. https://tdev-api.gbsl.website
4. check that ALLOWED_ORIGINS contains your frontend url, e.g. https://tdev.gbsl.website
5. check that you have set a unique APP_NAME, since it is used as a prefix for session cookies
6. make sure to keep the frontend up-to-date with feature: use better-auth teaching-dev#246
7. To use node v22.15.0, you must probably update the buildpack on dokku with

   dokku buildpacks:set-property dev-teaching-api stack gliderlabs/herokuish:latest

8. edit your Azure/Entrada Config:

• you can delete the frontend app (GYMB TEACHING-APP...)
• remove the API config (API Domains and authorized API client apps)
• add a client secret and add it in the env as MSAL_CLIENT_SECRET
• add a redirect-url (type WEB) pointing to your api endpoint. for https://tdev-api.gbsl.website this would be https://tdev-api.gbsl.website/api/auth/callback/microsoft

Closes #45