feat: add typed Better Auth route policies

[kauandotnet]

What changed

• adds a typed routePolicy option with normalized request context
• evaluates policy after CORS/body recovery and before middleware/Better Auth
• supports short-circuit Web responses and preserves direct auth.api behavior
• covers Express and Fastify JSON, form, CORS, error, and non-execution cases
• prepares @nestm/better-auth@0.1.0-alpha.2

Why

Station needs a Nest-owned, adapter-neutral policy seam for its deliberately narrow Better Auth HTTP surface without reintroducing a Fastify-specific mount.

Verification

• pnpm check
• Express suite: 144 passing
• Fastify suite: 144 passing
• build, pack dry-run, publint, and package-surface checks