feat: add better auth sqlite runtime and server-side session flow

.env.example

@@ -1,14 +1,28 @@
 # Public URL where users open Neta.
 NEXT_PUBLIC_SITE_URL=http://localhost:3000
 
-# Supabase project API URL, for example:
-# https://your-project-ref.supabase.co
+# Canonical server-side app URL used by auth callbacks and trusted origin checks.
+# Defaults to NEXT_PUBLIC_SITE_URL when empty.
+APP_URL=
+
+# Optional Better Auth base URL override. Defaults to APP_URL/NEXT_PUBLIC_SITE_URL.
+BETTER_AUTH_URL=
+
+# Required at production runtime. Generate with: openssl rand -base64 32
+BETTER_AUTH_SECRET=
+
+# Optional comma-separated extra trusted origins. Wildcards are rejected.
+TRUSTED_ORIGINS=
+
+# Persistent application data directory. In Docker this should be /app/data.
+DATA_DIR=.data
+
+# Optional explicit SQLite database path. Defaults to DATA_DIR/neta.db.
+DATABASE_PATH=
+
+# Legacy Supabase values are kept only while old feature data screens are being migrated.
 NEXT_PUBLIC_SUPABASE_URL=
 
-# Supabase anon/public key.
 NEXT_PUBLIC_SUPABASE_ANON_KEY=
 
-# Supabase service role key. Required for creating the first admin,
-# creating client portal users, and server-side storage uploads.
-# Keep this secret. Never expose it with a NEXT_PUBLIC_ prefix.
 SUPABASE_SERVICE_ROLE_KEY=