feat(api): add better-auth admin plugin + close public sign-up (migration 0002)

apps/api/src/auth.ts

@@ -1,6 +1,6 @@
 import { betterAuth } from 'better-auth';
 import { drizzleAdapter } from 'better-auth/adapters/drizzle';
-import { bearer } from 'better-auth/plugins';
+import { admin, bearer } from 'better-auth/plugins';
 import { db } from './db/client';
 import * as schema from './db/schema';
 import { env } from './env';
@@ -13,6 +13,7 @@ export const auth = betterAuth({
   emailAndPassword: {
     enabled: true,
     requireEmailVerification: false,
+    disableSignUp: true, // admin creates users; see docs/plans/phase-2-accounts-roles.md
   },
-  plugins: [bearer()],
+  plugins: [bearer(), admin({ defaultRole: 'worker', adminRoles: ['admin'] })],
 });