[mmcintosh]

Description

Better Auth signs in against auth_account.password, the credential row. Five SonicJS paths set a password but write only auth_user.password_hash:

• POST /auth/reset-password (forgot password);
• POST /auth/accept-invitation;
• POST /admin/profile/password (change my password);
• PUT /admin/users/:id (admin sets a user's password);
• POST /admin/users/new (admin creates a user).

So a reset or changed password fails at sign-in and the old one keeps working. Invited users and users created by an admin can't sign in until a later full bootstrap happens to backfill the row (up to 24 hours with the KV marker). The register form has the same bug, fixed in #1104.

This PR also fixes how the reset and invitation links are built. They came from the request's Origin header. /auth/request-password-reset is anonymous and CSRF-exempt, so anyone could have a real reset token emailed to a victim inside a link to their own site. Once this PR makes resets reach Better Auth, that would be an account takeover.

No open issue. Found while testing the fixes for #1054.

Changes

• New auth/credential-account.ts, credentialPasswordStatements():
  • it updates the user's existing credential row, whatever its id (Better Auth sign-ups use a random one);
  • if there is none, it inserts cred-${userId} (INSERT … SELECT … WHERE NOT EXISTS);
  • it runs in the same db.batch as the auth_user write, on all five paths above.
• New utils/site-origin.ts, siteOrigin(): links use BETTER_AUTH_URL when it is set, otherwise the origin of the URL the request was served on, never the Origin header. It is used for the reset link and both invitation links. Behind a proxy that doesn't pin Host (self-host or Docker), set BETTER_AUTH_URL.
• Self-host / Docker: docker-compose.yml defaults BETTER_AUTH_URL to http://localhost:3000. Set it to the public URL, or emailed reset and invitation links point at that default.
• Not in this PR:
  • Existing sessions are not ended when a password is reset or set by an admin. SonicJS has no session-revocation mechanism yet; that's a follow-up.

Testing

• password-change-credential.integration.test.ts (new, 5 tests): each route is driven on real SQLite, then signed in through a real Better Auth instance. The new password returns 200; for profile change, admin edit and reset, the old one returns 401. It covers a Better Auth sign-up (update path) and an invited user (insert path). All 5 fail without the fix.
• reset-link-origin.integration.test.ts (new, 2 tests): with Origin: https://evil.example, the emailed link uses BETTER_AUTH_URL, or the request's own URL when that isn't set. Both fail without the fix.
• The tests also pass on Better Auth 1.7.7 (fix(auth): move to Better Auth 1.7.7 and better-auth-cloudflare 0.4.1 #1103).

Unit Tests

• Added/updated unit tests
• All unit tests passing (this branch: 1937 / 0; all five batch PRs merged: 2000 / 0)

E2E Tests

• Added/updated E2E tests: 115-password-change-login.spec.ts (@auth). Admin creates a user, then the user logs in. The admin then sets a new password: the new one works and the old one gets 401.
• All E2E tests passing (not run locally, per the repo's E2E policy)

Screenshots/Videos

N/A. No UI changes; the forms are the same, and the change is what the server writes.

Checklist

• Code follows project conventions
• Tests added/updated and passing
• Type checking passes
• No console errors or warnings
• Documentation updated (if needed): the self-host BETTER_AUTH_URL note above