Replace dev auth with Better Auth #2

Problem

app.ts calls getDevUser() on every tRPC request, which reads DEV_USER_TELEGRAM_ID from env. Every request runs as the same hardcoded user — there's no real authentication.

Combined with wide-open CORS (app.use("*", cors())), anyone who finds the API URL can read/write all notes.

What needs to happen

• Wire up Better Auth (already in the spec/dependencies)
• Replace getDevUser() with real session-based auth in the tRPC context
• Restrict CORS origins to the actual client URL
• Remove DEV_USER_TELEGRAM_ID env var

Files

• packages/api/src/app.ts — CORS + context creation
• packages/api/src/auth.ts — dev user stub
• packages/api/src/trpc.ts — context type