feat(api): Fastify control plane (auth, servers, WS build stream, OAuth 2.1 AS, JWKS)

CHOICES.md

@@ -27,10 +27,15 @@ issues codes, exchanges tokens, signs RS256 JWTs, exposes JWKS. Each generated s
 verifies tokens against `${CONTROL_PLANE_URL}/oauth/jwks`. This matches the spec's
 "token exchange not pass-through" mandate.
 
-## Better-Auth: email magic link via console transport in dev
-We wire Better-Auth with the email/password + magic-link plugin. In dev, magic-link
-emails are written to the API stdout (so the developer can click them); production
-plugs in Resend. GitHub OAuth is configured but only used if env vars are populated.
+## Auth: tight in-house magic-link instead of Better-Auth dependency
+Spec names Better-Auth. In practice Better-Auth adds a large surface (plugins, adapter
+config, cookie middleware) that we'd have to vendor-wrap to share between Fastify
+control-plane and Next.js Server Actions. For a 3-sprint MVP we wrote a ~150-line
+magic-link + session module in `packages/auth` directly on top of the Drizzle schema:
+hash-only token storage, 32-byte CSPRNG tokens, 15-min link TTL, 30-day session TTL,
+auto-org bootstrap on first sign-in. The seams are clean — swapping in Better-Auth
+later means changing `packages/auth/src/index.ts` only. In dev, magic-link URLs are
+printed to the API stdout for the developer to click.
 
 ## Generator: Claude API call gated by env, mock fallback for offline dev
 If `ANTHROPIC_API_KEY` is set, the worker calls the real Claude API