chore: fix board — better-auth IS the decision, add enterprise auth, sync docs

Corrected:
- Auth: Passport.js → better-auth (Sequelize blocker removed by Drizzle)
- Added: izw.16 (better-auth migration), izw.17 (SAML), izw.18 (CAC/PIV), izw.19 (Kerberos)
- Closed: izw.5 (2FA) + izw.6 (sessions) — superseded by better-auth plugins
- Updated all 3 strategy docs to reflect better-auth decision
- Board now matches all user decisions: better-auth, Drizzle, Zod, clean scaffold

Authored by: Aaron Lippold<lippold@gmail.com>

Author: aaronlippold