Add calendar time tracking and tighten app auth/routing

[Berget1411]

Remove GitHub auth wiring and normalize session cookies

[greptile-apps]

Greptile Summary

This PR removes GitHub OAuth support (provider config, UI button, workflow secrets, and Cloudflare Worker bindings) and normalises session-cookie handling by extracting extractSessionToken / buildSessionTokenCookieHeader into a shared packages/auth/src/lib/session-cookie.ts utility.

The cookie normalization is a real bug-fix: the previous create-context.ts and organization.service.ts only searched for better-auth.session_token (non-prefixed), while Better Auth on HTTPS writes __Secure-better-auth.session_token. The new helpers try both names in priority order, fixing silent auth failures for org-service calls in production.

Confidence Score: 5/5

Safe to merge — the changes are a clean removal of GitHub OAuth and a correct normalization of session cookie parsing that fixes a production auth bug.

All findings are P2 or lower. The cookie-normalization change is a genuine fix (old code only searched for the non-prefixed cookie name, silently breaking org-service calls in production where Better Auth uses the __Secure- prefix). No regressions introduced; dev and prod paths both handled correctly by the new helpers.

No files require special attention.

Important Files Changed

Filename	Overview
packages/auth/src/lib/session-cookie.ts	New shared utility for extracting and building Better Auth session cookie headers; correctly handles both __Secure- prefix (HTTPS/prod) and non-prefixed (HTTP/dev) variants and preserves = characters in token values.
apps/server/src/trpc/create-context.ts	Replaces inlined non-prefixed-only cookie parsing with extractSessionToken; now correctly resolves session tokens in both dev and prod environments.
packages/api/src/modules/organization/organization.service.ts	Switches fake-header construction from a hardcoded non-prefixed cookie string to buildSessionTokenCookieHeader, fixing org-service API calls that silently failed in production.
packages/auth/src/index.ts	GitHub social provider removed; only Google OAuth remains. No other behavioral changes.
apps/web/src/features/auth/components/oauth-buttons.tsx	New component that renders only the Google OAuth button after dropping GitHub; loading state and invitation-aware callback URL are handled correctly.

_{Reviews (1): Last reviewed commit: "Remove GitHub auth wiring and normalize ..." | Re-trigger Greptile}