Wire frontend to the backend: auth, organizations, real patient API

Connects the UI-only app to the new backend over Better Auth + a small
patient API client, replacing the in-memory fixture and placeholder identity.

- Better Auth React client (lib/auth-client.ts) + shared access-control
  roles; API client (lib/api-client.ts) sending credentials cross-origin.
- Designed (auth) route group: login, signup, verify-email, forgot/reset
  password, clinic onboarding, and accept-invite.
- proxy.ts (this Next's renamed middleware) optimistic redirect + an
  authoritative client AppAuthGuard requiring a session and active clinic.
- Real identity in nav-user (useSession + sign out); the unused team
  switcher repurposed as an organization (clinic) switcher; Care-team
  settings tab manages members and invitations.
- lib/patients.ts now calls the org-scoped API (types unchanged); patients
  table and create/edit dialog updated for async create/update.
- next.config: standalone output + Dockerfile for containerized runs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/components/settings/settings-view.tsx

@@ -8,6 +8,7 @@ import {
   SettingsSection,
 } from "@/components/settings/settings-parts";
 import { SigningPanel } from "@/components/settings/settings-billing";
+import { CareTeamPanel } from "@/components/settings/settings-care-team";
 import { ProfilePanel } from "@/components/settings/settings-preferences";
 
 const TABS = [
@@ -71,12 +72,7 @@ export function SettingsView() {
           />
         )}
         {tab === "Signing" && <SigningPanel />}
-        {tab === "Care team" && (
-          <PlaceholderPanel
-            description="Clinicians with access to this workspace"
-            title="Care team"
-          />
-        )}
+        {tab === "Care team" && <CareTeamPanel />}
         {tab === "Developers" && (
           <PlaceholderPanel
             description="Access tokens for the temetro API"