Wire frontend to the backend: auth, organizations, real patient API

Connects the UI-only app to the new backend over Better Auth + a small
patient API client, replacing the in-memory fixture and placeholder identity.

- Better Auth React client (lib/auth-client.ts) + shared access-control
  roles; API client (lib/api-client.ts) sending credentials cross-origin.
- Designed (auth) route group: login, signup, verify-email, forgot/reset
  password, clinic onboarding, and accept-invite.
- proxy.ts (this Next's renamed middleware) optimistic redirect + an
  authoritative client AppAuthGuard requiring a session and active clinic.
- Real identity in nav-user (useSession + sign out); the unused team
  switcher repurposed as an organization (clinic) switcher; Care-team
  settings tab manages members and invitations.
- lib/patients.ts now calls the org-scoped API (types unchanged); patients
  table and create/edit dialog updated for async create/update.
- next.config: standalone output + Dockerfile for containerized runs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/lib/access.ts

@@ -0,0 +1,45 @@
+import { createAccessControl } from "better-auth/plugins/access";
+import {
+  adminAc,
+  memberAc,
+  ownerAc,
+  defaultStatements,
+} from "better-auth/plugins/organization/access";
+
+// Mirrors backend/src/lib/access.ts so the client's permission checks
+// (organization.hasPermission / checkRolePermission) match the server.
+export const statements = {
+  ...defaultStatements,
+  patient: ["read", "write", "delete"],
+} as const;
+
+export const ac = createAccessControl(statements);
+
+export const owner = ac.newRole({
+  ...ownerAc.statements,
+  patient: ["read", "write", "delete"],
+});
+
+export const admin = ac.newRole({
+  ...adminAc.statements,
+  patient: ["read", "write", "delete"],
+});
+
+export const member = ac.newRole({
+  ...memberAc.statements,
+  patient: ["read", "write"],
+});
+
+export const viewer = ac.newRole({
+  patient: ["read"],
+});
+
+export const roles = { owner, admin, member, viewer };
+
+// Human-readable labels for the role keys used in the UI.
+export const ROLE_LABELS: Record<keyof typeof roles, string> = {
+  owner: "Owner",
+  admin: "Admin",
+  member: "Clinician",
+  viewer: "Viewer",
+};