Better Auth workspaces: sign-in and tenant isolation on the live stack

MSH OS auth ships on /login and /register under the same locale routing as the marketing site. Sessions use production secrets; workspace APIs enforce tenant boundaries before any CRM or project read.

Platform admin remains a separate surface with stricter controls. Shop Stripe and SaaS billing are intentionally separate ledgers — a pattern we keep repeating because mixing them creates reconciliation nightmares.

For users testing today: create an account, expect email verification to be optional until SMTP is wired, and treat CRM data as real tenant-scoped data — not a demo sandbox on production.