feat: Support built-in authentication in the Cloudflare host

[Adityakk9031]

Problem

The Cloudflare host currently requires Cloudflare Access. The Worker returns an unavailable response when ACCESS_TEAM_DOMAIN or ACCESS_AUD is absent.
This requirement makes Cloudflare Access part of the host's security and deployment model, preventing operators who cannot or do not want to enroll in Zero Trust from using the hosted Worker deployment.

Proposal

This PR adds an opt-in built-in authentication mode (AUTH_MODE=builtin) to apps/host-cloudflare, while keeping AUTH_MODE=access as the default.

Key Changes

1. Decoupled and Extracted Better Auth Logic:
   • Extracted the Better Auth configurations, identity mappings, account provider, MCP OAuth providers, invite codes, and seed helpers from apps/host-selfhost into the shared packages/core/api package (under @executor-js/api/server).
   • Decoupled Better Auth database operations from specific SQL clients by introducing a storage-agnostic BetterAuthDbClient interface.
2. Refactored Self-Host:
   • Refactored apps/host-selfhost to consume the extracted shared Better Auth components, ensuring 100% regression-free backward compatibility.
3. Cloudflare Worker Built-in Auth Implementation:
   • Added a d1ClientAdapter wrapper to implement the shared BetterAuthDbClient over Cloudflare D1.
   • Updated configuration loading to require BETTER_AUTH_SECRET (or AUTH_SECRET) when AUTH_MODE=builtin, failing closed if it is absent or less than 32 characters.
   • Mounted Better Auth (/api/auth/*), Admin (/api/admin/*), and System (/api/setup-status) routes in host-cloudflare when running in built-in mode.
   • Provided dynamic MCP session/approval authentication (verifies Access JWKS JWT in Access mode, and Better Auth sessions in Builtin mode).
4. Frontend SPA Integration:
   • Deleted the duplicate web SPA folder in apps/host-cloudflare.
   • Pointed apps/host-cloudflare's Vite build configuration directly to apps/host-selfhost/web/.
   • Updated the unified __root.tsx route to query /api/setup-status at boot to dynamically resolve the auth mode (redirecting to /cdn-cgi/access/login on 404/Access mode, and rendering Setup/Login pages in Builtin mode).
5. Added E2E Coverage:
   • Added detailed workerd E2E integration test suite covering setup status checks, first-run admin registration, invite code generation, invite code signup restrictions, and multi-user credential/session isolation.

Closes #1793

[Adityakk9031]

@RhysSullivan have a look .happy for feedback