refactor(plugin-auth): move the better-auth global before-hook into auth-manager-before-hook.ts

The body of the arrow createAuthInstance passes to createAuthMiddleware
for hooks.before moves unedited into globalBeforeHook, re-indented four
levels. hooks.before keeps its place in the config literal; its arrow
now builds one host of the nineteen AuthManager members the body reads
(eighteen methods as late-bound closures, config as a getter) and
returns globalBeforeHook.call(host, ctx, setShouldSkipSessionRefresh).
The async moved from the arrow to the function. The one
createAuthInstance local the arrow read, setShouldSkipSessionRefresh,
is the function's second parameter under the same name; the body's one
static read, AuthManager.OPERATOR_PROVISIONING_TICKET_FIELD, is a value
import of the class, read at call time. Nine imports leave
auth-manager.ts with it.

Two readers outside the move follow it: the api-error-code pin counts
the new module among the auth manager's files, and the vocabulary
gate's APIError argument census names it as the live member's file.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LSXBc2GCBwiAL7vV4kWkyr

Author: claude

packages/plugins/plugin-auth/src/api-error-code.pin.test.ts

@@ -181,6 +181,7 @@ describe('every new APIError( in plugin-auth/src carries an ADR-0112 code (#2424
       'auth-manager-sign-in-lockout.ts',
       'auth-manager-password-session-policy.ts',
       'auth-manager-email-sms-delivery.ts',
+      'auth-manager-before-hook.ts',
     ];
     expect(sites.length).toBeGreaterThanOrEqual(30);
     expect(new Set(sites.map((s) => s.file)).size).toBeGreaterThanOrEqual(4);