Declare typed Convex env and route auth through @code/env/convex

- Register SITE_URL, NATIVE_APP_URL, CONVEX_SITE_URL, FLUE_DB_TOKEN in
  convex.config.ts so the generated server.js exposes a typed env object.
- Rewrite auth.ts to consume @code/env/convex and tighten the
  getCurrentUser handler.
- Refresh the backend README to describe the control-plane role and
  generated-file policy.

packages/backend/convex/_generated/api.d.ts

@@ -12,6 +12,7 @@ import type * as auth from "../auth.js";
 import type * as daemonCommands from "../daemonCommands.js";
 import type * as daemonRuntime from "../daemonRuntime.js";
 import type * as daemons from "../daemons.js";
+import type * as fluePersistence from "../fluePersistence.js";
 import type * as healthCheck from "../healthCheck.js";
 import type * as http from "../http.js";
 import type * as privateData from "../privateData.js";
@@ -28,6 +29,7 @@ declare const fullApi: ApiFromModules<{
   daemonCommands: typeof daemonCommands;
   daemonRuntime: typeof daemonRuntime;
   daemons: typeof daemons;
+  fluePersistence: typeof fluePersistence;
   healthCheck: typeof healthCheck;
   http: typeof http;
   privateData: typeof privateData;