plugin
authGate() - the AppKit adapter around @dbx-tools/auth.
It has NO routes of its own: the tunnel PROXY (not an HTTP server) calls the
handlers this plugin exposes via AuthGatePlugin.exports. The plugin
owns tunnel authorization, AppKit Lakebase discovery, email delivery, and
transport mounting. Better Auth owns users, OTPs, sessions, rate limits, and
passkeys. createApp can run this plugin with or without server().
Options come from CLI flags OR env, with sensible defaults - see
resolveAuthGateConfig. The one runtime dependency the plugin can’t
resolve itself is HOW to email the code, so it takes a sendCode callback the
app wires to the email plugin.