Fix Foundry auth: migrate to Better Auth adapter, fix access token retrieval

- Remove @ts-nocheck from better-auth.ts, auth-user/index.ts, app-shell.ts
  and fix all type errors
- Fix getAccessTokenForSession: read GitHub token directly from account
  record instead of calling Better Auth's internal /get-access-token
  endpoint which returns 403 on server-side calls
- Re-implement workspaceAuth helper functions (workspaceAuthColumn,
  normalizeAuthValue, workspaceAuthClause, workspaceAuthWhere) that were
  accidentally deleted
- Remove all retry logic (withRetries, isRetryableAppActorError)
- Implement CORS origin allowlist from configured environment
- Document cachedAppWorkspace singleton pattern
- Add inline org sync fallback in buildAppSnapshot for post-OAuth flow
- Add no-retry rule to CLAUDE.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

foundry/packages/shared/src/contracts.ts

@@ -172,6 +172,23 @@ export const RepoOverviewSchema = z.object({
   baseRef: z.string().nullable(),
   stackAvailable: z.boolean(),
   fetchedAt: z.number().int(),
+  branchSyncAt: z.number().int().nullable(),
+  prSyncAt: z.number().int().nullable(),
+  branchSyncStatus: z.enum(["pending", "syncing", "synced", "error"]),
+  prSyncStatus: z.enum(["pending", "syncing", "synced", "error"]),
+  repoActionJobs: z.array(
+    z.object({
+      jobId: z.string().min(1),
+      action: z.enum(["sync_repo", "restack_repo", "restack_subtree", "rebase_branch", "reparent_branch"]),
+      branchName: z.string().nullable(),
+      parentBranch: z.string().nullable(),
+      status: z.enum(["queued", "running", "completed", "error"]),
+      message: z.string().min(1),
+      createdAt: z.number().int(),
+      updatedAt: z.number().int(),
+      completedAt: z.number().int().nullable(),
+    }),
+  ),
   branches: z.array(RepoBranchRecordSchema),
 });
 export type RepoOverview = z.infer<typeof RepoOverviewSchema>;
@@ -189,8 +206,10 @@ export const RepoStackActionInputSchema = z.object({
 export type RepoStackActionInput = z.infer<typeof RepoStackActionInputSchema>;
 
 export const RepoStackActionResultSchema = z.object({
+  jobId: z.string().min(1).nullable().optional(),
   action: RepoStackActionSchema,
   executed: z.boolean(),
+  status: z.enum(["queued", "running", "completed", "error"]).optional(),
   message: z.string().min(1),
   at: z.number().int(),
 });