Add the MVP authentication layer using Better Auth with Convex integration. The MVP is single-user focused: one admin user protects the dashboard while public audit pages remain accessible without login according to their publication status.
Acceptance Criteria
#1 Better Auth is integrated with Convex and the Next.js app
#2 Email/password login protects all internal dashboard routes
#3 Public audit routes remain accessible without dashboard authentication
#4 Session handling survives refreshes and rejects unauthenticated dashboard access
#5 Password-change or admin-account maintenance path is available or explicitly documented for MVP operation
Implementation Plan
Install and configure Better Auth with Convex integration.
Add login/logout flows using shadcn-compatible UI.
Protect dashboard route groups with server-side/session checks.
Keep public audit pages outside the protected route boundary.
Test authenticated, unauthenticated, and logout flows.
