feat: establish core identity foundation

Adds Core-owned identity contracts, a Core-owned Better Auth database schema
(ekklesia_core_user/session/account/verification), a first-class Core-owned
migration source that coexists with module-owned migrations under the exact
existing migration system, and an explicit Better Auth construction boundary.
No authentication endpoint or sign-in UI is exposed yet (ADR 0010).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

core/identity-schema-generator.config.ts

@@ -0,0 +1,19 @@
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+
+/**
+ * Drives the pinned Better Auth CLI's canonical schema generator for
+ * `pnpm identity:schema:generate` and `pnpm identity:schema:validate`.
+ *
+ * This file is a development-time aid only: it is never imported by application, factory, or
+ * runtime code, never opens a database connection, and intentionally omits our custom table
+ * names so the generator always produces Better Auth's official default (unrenamed) schema for
+ * comparison against core/src/identity/schema.ts. Do not add plugins or providers here.
+ */
+export const auth = betterAuth({
+  database: drizzleAdapter({} as never, {
+    provider: "pg",
+  }),
+  secret: "0".repeat(32),
+  baseURL: "https://identity-schema-generator.invalid",
+});