Migrate the API to native ESM and vitest; pin Node 26

Prep PR for the admin auth module (docs/plan-admin-auth.md step 1).
better-auth 1.7 ships ESM only, so the API moves off CommonJS:

- "type": "module", module nodenext, target ES2024, .js suffixes on all
  relative imports, require('mariadb'|'cors') replaced by imports, and
  export= packages (winston, app-root-path, bcrypt) consumed via default
  imports. The logger now uses appRoot.path explicitly.
- TypeScript 5.9, @types/node 26, tslint removed. Node 26 pinned via
  engines and .nvmrc (Plesk runs 26).
- Jest 28 + ts-jest replaced by vitest 5. Eight test files depend on
  hoisted module mocks with static imports and resetModules + require,
  which Jest's ESM mode does not support; vitest keeps them nearly
  verbatim. Coverage via @vitest/coverage-v8 (lcov), Sonar generic report
  via vitest-sonar-reporter, so sonar-project.properties is unchanged.
  vitest.config.ts sets FEEDBACK_IP_SALT so the suite passes without a
  local .env.
- dotenv 8 -> 16 and axios 0.24 -> 1.x: their old typings are not
  resolvable under nodenext.
- autoCommit: false dropped from the pool configs; it is not a mariadb
  connector option and was silently ignored.

tsc clean, 96/96 tests green, compiled app boots and serves /, /docs and
CORS under Node ESM.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

vitest.config.ts

@@ -0,0 +1,25 @@
+import {defineConfig} from 'vitest/config';
+
+export default defineConfig({
+	test: {
+		include: ['test/**/*.test.ts'],
+		environment: 'node',
+		// feedback.ratelimit throws at import time without a salt (see
+		// test/feedback/ratelimit.salt-guard.test.ts). Set one here so the suite
+		// passes on a clean checkout without a local .env; the salt-guard test
+		// deletes it explicitly before exercising the missing-salt path.
+		env: {
+			FEEDBACK_IP_SALT: 'vitest-salt'
+		},
+		reporters: [
+			'default',
+			['vitest-sonar-reporter', {outputFile: 'testResults/sonar-report.xml'}]
+		],
+		coverage: {
+			provider: 'v8',
+			reporter: ['text-summary', 'lcov'],
+			reportsDirectory: 'coverage',
+			include: ['app.ts', 'src/**/*.ts']
+		}
+	}
+});