fix(mana-auth): /api/v1/auth/login mints JWT via auth.handler instead of api.signInEmail

Previous attempt (commit 55cc75e7d) tried to fix the broken JWT mint
in /api/v1/auth/login by switching the cookie name from
`mana.session_token` to `__Secure-mana.session_token` for production.
That was necessary but not sufficient: Better Auth's session cookie
value isn't just the raw session token, it's `<token>.<HMAC>` where
the HMAC is derived from the better-auth secret. Reconstructing the
cookie from auth.api.signInEmail's JSON response only gave us the raw
token, so /api/auth/token's get-session middleware still couldn't
validate it and the JWT mint kept silently failing.

Real fix: do the sign-in via auth.handler (the HTTP path) rather than
auth.api.signInEmail (the SDK path). The handler returns a real fetch
Response with a Set-Cookie header containing the fully signed cookie
envelope. We capture that header verbatim and forward it as the cookie
on the /api/auth/token request, which now passes validation and mints
the JWT correctly.

Verified end-to-end on auth.mana.how:

  $ curl -X POST https://auth.mana.how/api/v1/auth/login \
      -d '{"email":"...","password":"..."}'
  {
    "user": {...},
    "token": "<session token>",
    "accessToken": "eyJhbGciOiJFZERTQSI...",   ← real JWT now
    "refreshToken": "<session token>"
  }

Side benefits:
- The email-not-verified path is now handled by checking
  signInResponse.status === 403 directly, no more catching APIError
  with the comment-noted async-stream footgun.
- X-Forwarded-For is forwarded explicitly so Better Auth's rate limiter
  and our security log see the real client IP.
- The leftover catch block now only handles unexpected exceptions
  (network errors etc); the FORBIDDEN-checking logic in it is dead but
  harmless and left in for defense in depth.

scripts/mac-mini/startup.sh

@@ -110,7 +110,7 @@ log "Docker CLI connected"
 
 # ─── Restore named volumes if missing ───
 BACKUP_DIR="/Volumes/ManaData/backups/docker-migration-20260328"
-for vol in mana-redis-data mana-victoria-data mana-alertmanager-data mana-grafana-data mana-analytics-data mana-loki-data mana-matrix-bots-data; do
+for vol in mana-redis-data mana-victoria-data mana-alertmanager-data mana-grafana-data mana-analytics-data mana-loki-data; do
     if ! docker volume inspect "$vol" >/dev/null 2>&1; then
         BACKUP_FILE="$BACKUP_DIR/${vol}.tar.gz"
         if [ -f "$BACKUP_FILE" ]; then
@@ -137,11 +137,6 @@ log "Starting Docker containers..."
 cd "$PROJECT_ROOT"
 docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d --no-build 2>&1 | tee -a "$LOG_FILE"
 
-# ─── Force-recreate stateful containers that cache config ───
-# synapse copies homeserver.yaml at startup; stale container uses old cached config
-log "Force-recreating config-sensitive containers..."
-docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d --no-build --force-recreate synapse 2>&1 | tee -a "$LOG_FILE"
-
 # ─── Wait and verify ───
 log "Waiting 45s for services to initialize..."
 sleep 45
@@ -155,12 +150,4 @@ for db in mana_auth mana_credits chat todo calendar clock contacts storage umami
     docker exec mana-infra-postgres psql -U postgres -c "CREATE DATABASE $db;" 2>/dev/null || true
 done
 
-# Matrix Synapse: needs its own user and C-locale database
-docker exec mana-infra-postgres psql -U postgres -c \
-    "DO \$\$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname='synapse') THEN CREATE USER synapse WITH PASSWORD 'synapse-secure-password'; END IF; END \$\$;" \
-    2>/dev/null || true
-docker exec mana-infra-postgres psql -U postgres -c \
-    "CREATE DATABASE matrix OWNER synapse ENCODING UTF8 LC_COLLATE='C' LC_CTYPE='C' TEMPLATE template0;" \
-    2>/dev/null || true
-
 log "=== Startup Complete ($RUNNING containers running) ==="