feat: enable auth openapi and password checks

tests/auth-worker.test.ts

@@ -18,9 +18,10 @@ describe("cfw-auth worker", () => {
     expect(response.status).toBe(404);
   });
 
-  it("routes Better Auth traffic through /api/auth/*", async () => {
+  it("exposes Better Auth OpenAPI reference", async () => {
     const response = await worker.fetch(new Request("http://auth.local/api/auth/reference"), env);
-    expect([200, 404, 500]).toContain(response.status);
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type") ?? "").toContain("text/html");
   });
 
   it("applies configured CORS origin for auth routes", async () => {