fix(auth): Configure bcrypt password hashing to match seed script

Critical fix for authentication:

Problem:
- Better Auth default: scrypt password hashing
- Seed script: bcrypt password hashing (bcrypt.hash(password, 10))
- Result: Seeded users cannot login (hash verification fails)

Solution:
Configure Better Auth to use bcrypt for both hashing and verification:

```typescript
emailAndPassword: {
  password: {
    hash: async (password) => {
      const bcrypt = await import("bcryptjs");
      return await bcrypt.hash(password, 10);
    },
    verify: async ({ hash, password }) => {
      const bcrypt = await import("bcryptjs");
      return await bcrypt.compare(password, hash);
    },
  },
}
```

Why bcrypt:
- Already used in seed script (scripts/seed-setup.ts)
- Already installed as dependency (bcryptjs)
- Widely adopted and secure (OWASP approved)
- Consistent hashing across app and seed scripts

Result:
✅ Seeded admin user ([email protected]) can now login
✅ All password authentication uses bcrypt
✅ No migration needed for existing users

Testing:
- Seed admin: pnpm seed:setup
- Login: [email protected] / Admin123!@#

Related: #21

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: mjunaidca

auth-server/src/lib/auth.ts

@@ -167,6 +167,18 @@ export const auth = betterAuth({
     minPasswordLength: 8,
     // Always require email verification for security
     requireEmailVerification: true,
+    // Use bcrypt for password hashing (matches seed script)
+    // Better Auth default is scrypt, but we use bcrypt for compatibility
+    password: {
+      hash: async (password) => {
+        const bcrypt = await import("bcryptjs");
+        return await bcrypt.hash(password, 10);
+      },
+      verify: async ({ hash, password }) => {
+        const bcrypt = await import("bcryptjs");
+        return await bcrypt.compare(password, hash);
+      },
+    },
     // Password reset (only when email is configured)
     ...(emailEnabled && {
       sendResetPassword: async ({ user, url }) => {