Fix Foundry auth: migrate to Better Auth adapter, fix access token retrieval

- Remove @ts-nocheck from better-auth.ts, auth-user/index.ts, app-shell.ts
  and fix all type errors
- Fix getAccessTokenForSession: read GitHub token directly from account
  record instead of calling Better Auth's internal /get-access-token
  endpoint which returns 403 on server-side calls
- Re-implement workspaceAuth helper functions (workspaceAuthColumn,
  normalizeAuthValue, workspaceAuthClause, workspaceAuthWhere) that were
  accidentally deleted
- Remove all retry logic (withRetries, isRetryableAppActorError)
- Implement CORS origin allowlist from configured environment
- Document cachedAppWorkspace singleton pattern
- Add inline org sync fallback in buildAppSnapshot for post-OAuth flow
- Add no-retry rule to CLAUDE.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

foundry/packages/backend/package.json

@@ -19,6 +19,7 @@
     "@iarna/toml": "^2.2.5",
     "@sandbox-agent/foundry-shared": "workspace:*",
     "@sandbox-agent/persist-rivet": "workspace:*",
+    "better-auth": "^1.5.5",
     "drizzle-kit": "^0.31.8",
     "drizzle-orm": "^0.44.5",
     "hono": "^4.11.9",