feat: add NestM auth control-plane services

[kauandotnet]

Summary

• add the strict mutation-origin guard and portable TypeORM capability boundary required by the integration harness
• add plugin-aware BetterAuthService.invokeApi() with Node/Web header normalization and stable Nest HTTP error translation
• add token-free BetterAuthSessionService operations plus an opt-in policy that blocks raw token-bearing Better Auth routes
• add a stock-1.6.26-compatible BetterAuthOrganizationService for members, invitations, ID-bound resend, terminal decisions, and post-commit session-selector reconciliation
• add an opt-in organization control-plane policy covering all raw member/invitation management routes
• add a PostgreSQL TypeORM lifecycle coordinator that shares one transaction and organization advisory lock with the Better Auth adapter
• make active-organization guards bypass cookie caches and verify live membership/permissions against the authoritative selector

Validation

• pnpm run check
• pnpm run verify:pack
• pnpm run test:express — 33 files, 280 tests
• pnpm run test:fastify — 33 files, 280 tests
• PG_URL=... pnpm run test:postgres — 8 files, 83 tests
• stock better-auth@1.6.26 is used by the package and all conformance tests

Guarantee boundary

Cross-process organization serialization requires the supplied PostgreSQL coordinator, the exact same coordinator getManager passed to typeormAdapter, and the opt-in raw-route policy. Direct auth.api calls bypass that boundary. Email/hooks, secondary storage, and signed cookie caches cannot commit atomically with PostgreSQL; durable external effects still require an outbox and live membership remains the authorization proof.

Related

• integration harness follow-up: a dedicated PR will consume this branch against registry better-auth@1.6.26
• optional Better Auth contribution: fix(organization): harden access lifecycle transitions better-auth/better-auth#10932; this NestM implementation does not depend on it

[kauandotnet]

Downstream stock-runtime validation is now open in kauandotnet/integration-api#1. That harness pins registry better-auth 1.6.26 and consumes this PR as the only implementation dependency; better-auth/better-auth#10932 is optional.