implement better-auth auth with postgres and route protection

.env.example

@@ -5,6 +5,13 @@ NPM_VERSION=latest
 # Local docker host port (used by docker-compose.override.yml)
 APP_PORT=3000
 
+# Better Auth / PostgreSQL
+DATABASE_URL=postgres://postgres:postgres@localhost:5432/fiscal_clone
+BETTER_AUTH_SECRET=replace-with-a-long-random-secret
+BETTER_AUTH_BASE_URL=http://localhost:3000
+BETTER_AUTH_ADMIN_USER_IDS=
+BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000
+
 # OpenClaw / ZeroClaw (OpenAI-compatible)
 OPENCLAW_BASE_URL=http://localhost:4000
 OPENCLAW_API_KEY=replace-with-your-agent-key