Declare typed Convex env and route auth through @code/env/convex

- Register SITE_URL, NATIVE_APP_URL, CONVEX_SITE_URL, FLUE_DB_TOKEN in
  convex.config.ts so the generated server.js exposes a typed env object.
- Rewrite auth.ts to consume @code/env/convex and tighten the
  getCurrentUser handler.
- Refresh the backend README to describe the control-plane role and
  generated-file policy.

packages/backend/convex/auth.ts

@@ -1,5 +1,7 @@
 import { expo } from "@better-auth/expo";
-import { createClient, type GenericCtx } from "@convex-dev/better-auth";
+import { env } from "@code/env/convex";
+import { createClient } from "@convex-dev/better-auth";
+import type { GenericCtx } from "@convex-dev/better-auth";
 import { convex, crossDomain } from "@convex-dev/better-auth/plugins";
 import { betterAuth } from "better-auth/minimal";
 
@@ -8,15 +10,14 @@ import type { DataModel } from "./_generated/dataModel";
 import { query } from "./_generated/server";
 import authConfig from "./auth.config";
 
-const siteUrl = process.env.SITE_URL!;
-const nativeAppUrl = process.env.NATIVE_APP_URL || "code://";
+const siteUrl = env.SITE_URL;
+const nativeAppUrl = env.NATIVE_APP_URL ?? "code://";
 
 export const authComponent = createClient<DataModel>(components.betterAuth);
 
-function createAuth(ctx: GenericCtx<DataModel>) {
-  return betterAuth({
-    baseURL: process.env.CONVEX_SITE_URL,
-    trustedOrigins: [siteUrl, nativeAppUrl, "exp://"],
+const createAuth = (ctx: GenericCtx<DataModel>) =>
+  betterAuth({
+    baseURL: env.CONVEX_SITE_URL,
     database: authComponent.adapter(ctx),
     emailAndPassword: {
       enabled: true,
@@ -30,14 +31,12 @@ function createAuth(ctx: GenericCtx<DataModel>) {
         jwksRotateOnTokenGenerationError: true,
       }),
     ],
+    trustedOrigins: [siteUrl, nativeAppUrl, "exp://"],
   });
-}
 
 export { createAuth };
 
 export const getCurrentUser = query({
   args: {},
-  handler: async (ctx) => {
-    return await authComponent.safeGetAuthUser(ctx);
-  },
+  handler: (ctx) => authComponent.safeGetAuthUser(ctx),
 });