- new @tripwire/auth: ./server (createAuth + posture guard, moved from db),
./client (browser client); boundary arrows + agents.md
- src/start.ts: createStart request middleware serves /api/auth/* on the web
head itself — same-origin cookies, oauth callback on :3000; vite proxy and
the api head's auth mount removed (root cause: nitro owns the pipeline, the
proxy never ran, the router 307'd /api/auth to /login)
- utils: portable UUIDv7 (nitro dev runtime is node — Bun.randomUUIDv7 threw
during better-auth's oauth state write); bun fast path kept
- verified end to end: POST :3000/api/auth/sign-in/social returns the github
authorize url
