refactor(env): centralize auth env handling and prefer BETTER_AUTH_BASE_URL

Backend/utils/device-token.ts

@@ -1,4 +1,5 @@
 import { createHmac, timingSafeEqual } from 'crypto';
+import { getRequiredEnv } from './env';
 
 type DeviceRole = 'camera' | 'client';
 
@@ -9,11 +10,7 @@ export type DeviceTokenPayload = {
   exp: number;
 };
 
-const secret = process.env.BETTER_AUTH_SECRET;
-
-if (!secret) {
-  throw new Error('BETTER_AUTH_SECRET is required for device token signing');
-}
+const secret = getRequiredEnv('BETTER_AUTH_SECRET');
 
 const base64UrlEncode = (input: string): string => Buffer.from(input, 'utf8').toString('base64url');
 const base64UrlDecode = (input: string): string => Buffer.from(input, 'base64url').toString('utf8');