fix: language default, google OAuth cookie issue, add admin tier/usage controls

- ai-generate-dialog: useLocale() returns {locale,setLocale} object, not
  string — was stringifying whole object as default language value
- auth/server: add trustedOrigins so session cookie survives reverse-proxy
  deployments where BETTER_AUTH_URL differs from container's own view
- admin: add tier limit editor (/admin/tiers) and per-user usage reset
  button, both audit-logged

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/auth/server.ts

@@ -5,6 +5,8 @@ import { db, users, sessions, accounts, verifications, eq, count } from "@epicur
 import { sendEmail, verifyEmailHtml, resetPasswordHtml, welcomeHtml } from "@/lib/email";
 
 export const auth = betterAuth({
+  trustedOrigins: [process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000"],
+
   database: drizzleAdapter(db, {
     provider: "pg",
     schema: { user: users, session: sessions, account: accounts, verification: verifications },