refactor(plugin-auth): move the createAuthInstance body into auth-manager-auth-instance.ts

The body of AuthManager.createAuthInstance() moves unedited into the
module function createAuthInstance, re-indented one level: the deferred
better-auth imports, the plugin list and password hasher, the whole
config literal (including the hooks.before and hooks.after arrows that
cuts 12 and 13 left in place), the betterAuth() call and the wait on
auth.$context. The method keeps its place, docblock, modifiers and
return type; it now builds one host of the forty-seven AuthManager
members the body reads (forty-five methods as late-bound closures,
config and idpLocale as getters) and returns
createAuthInstance.call(host). The async moved from the method to the
function.

readDisableSignUpEnv, the one top-level helper the body reads, is
exported in place and imported by value; src/index.ts names its
auth-manager.ts exports one by one, so nothing new is published. Ten
imported values leave auth-manager.ts with the body, and the cut 12 and
cut 13 hook imports are replaced by the new module's.

One reader outside the move follows it: the population comments in
auth-email-locale.test.ts name the new module among the files the five
sendTemplate sites live in.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LSXBc2GCBwiAL7vV4kWkyr

Author: claude

packages/plugins/plugin-auth/src/auth-email-locale.test.ts

@@ -858,8 +858,9 @@ describe("#14641 — an invitation reads the INVITEE's own sys_user.locale", ()
  *
  * ⚠️ POPULATION of the class claim these blocks close, stated rather than
  * implied: the auth mail surface is the five `sendTemplate` call sites in
- * `auth-manager.ts` and `auth-manager-email-sms-delivery.ts` (the body of the
- * change-email notice) — `IEmailService` declares exactly two delivering
+ * `auth-manager.ts`, `auth-manager-auth-instance.ts` (the body of
+ * `createAuthInstance`) and `auth-manager-email-sms-delivery.ts` (the body of
+ * the change-email notice) — `IEmailService` declares exactly two delivering
  * members (`send`, `sendTemplate`), plugin-auth's only `.send(` calls are the
  * SMS service's, and no other file under `plugin-auth/src` calls either.
  * Those five are the same five `driveAllFive` above drives and `TEMPLATES`
@@ -1122,9 +1123,9 @@ describe('#15106 — the CLASS claim: all five auth sends read the recipient col
   });
 
   it('every one of the five sends is written in the stored language of its own recipient', async () => {
-    // ⚠️ POPULATION: the five `sendTemplate` sites in `auth-manager.ts` and
-    // `auth-manager-email-sms-delivery.ts` — the same five `driveAllFive`
-    // drives and `TEMPLATES` names, and the whole of
+    // ⚠️ POPULATION: the five `sendTemplate` sites in `auth-manager.ts`,
+    // `auth-manager-auth-instance.ts` and `auth-manager-email-sms-delivery.ts`
+    // — the same five `driveAllFive` drives and `TEMPLATES` names, and the whole of
     // plugin-auth's mail surface (see this section's header). This is the pin
     // that closes the class; the per-send pins above only cover one member.
     //