Declare typed Convex env and route auth through @code/env/convex

- Register SITE_URL, NATIVE_APP_URL, CONVEX_SITE_URL, FLUE_DB_TOKEN in
  convex.config.ts so the generated server.js exposes a typed env object.
- Rewrite auth.ts to consume @code/env/convex and tighten the
  getCurrentUser handler.
- Refresh the backend README to describe the control-plane role and
  generated-file policy.

packages/backend/convex/convex.config.ts

@@ -1,7 +1,14 @@
 import betterAuth from "@convex-dev/better-auth/convex.config";
 import { defineApp } from "convex/server";
+import { v } from "convex/values";
 
-const app = defineApp();
+const app = defineApp({
+  env: {
+    NATIVE_APP_URL: v.optional(v.string()),
+    SITE_URL: v.string(),
+    FLUE_DB_TOKEN: v.string(),
+  },
+});
 app.use(betterAuth);
 
 export default app;