fix: restore Better Auth route path literals

[BunsDev]

Motivation

• A recent rename inadvertently replaced Better Auth route template string literals (/...) with package-like tokens (@opencoven-feedback/...), breaking ctx.path matching and disabling critical pre-/post-auth policy enforcement such as SSO hard-binding and workspace 2FA gates.
• This change restores the original slash-prefixed route templates and correct redirect targets so the auth hooks again match real ctx.path values and enforce policy.

Description

• Replaced package-like path tokens in apps/web/src/lib/server/auth/hooks.ts with the original Better Auth route templates (e.g. '/sign-in/email', '/magic-link/verify', '/oauth2/callback/:providerId') used by inferProvider, SESSION_CREATING_CALLBACK_PATHS, and NO_EMAIL_BEFORE_PATHS.
• Restored SSO callback checks to '/oauth2/callback/:providerId' so handleSsoCallbackAfter and handleAutoProvisionAfter run for real callbacks.
• Restored credential/magic-link path sets and 2FA audit keys (CREDENTIAL_SIGN_IN_PATHS, MAGIC_LINK_VERIFY_PATHS, TWO_FACTOR_AUDIT_PATHS) and normalized redirect targets to application routes (e.g. '/admin/login', '/auth/login', '/auth/two-factor-setup-required').
• Changes are confined to apps/web/src/lib/server/auth/hooks.ts and preserve the existing policy logic and hook structure.

Testing

• Ran unit test bun test apps/web/src/lib/server/auth/__tests__/infer-provider.test.ts, which was blocked and errored with Cannot find module 'better-auth/api' because dependencies were not installed.
• Attempted bun install, which failed due to registry 403 responses for dependency tarballs, preventing a full test run.
• Ran type-check with bun run typecheck (tsc --noEmit), which failed due to missing type definition packages after the failed install (errors for @testing-library/jest-dom and bun).

---

Codex Task

[Copilot]

Pull request overview

Restores Better Auth ctx.path route template literals (slash-prefixed paths) in the server auth hooks so path-based provider inference and pre-/post-auth policy enforcement (SSO hard-binding, 2FA gates, cleanup/auditing) matches real Better Auth hook inputs again.

Changes:

• Replaced incorrect package-like tokens (e.g. @opencoven-feedback/...) with Better Auth route templates (e.g. '/sign-in/email', '/oauth2/callback/:providerId') for provider inference and path-set guards.
• Normalized redirect targets back to application routes (e.g. '/admin/login', '/auth/login', '/auth/two-factor-setup-required') used by the web app.
• Restored SSO callback matching to '/oauth2/callback/:providerId' so SSO post-processing hooks run on actual callbacks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.