fix: language default, google OAuth cookie issue, add admin tier/usage controls

- ai-generate-dialog: useLocale() returns {locale,setLocale} object, not
  string — was stringifying whole object as default language value
- auth/server: add trustedOrigins so session cookie survives reverse-proxy
  deployments where BETTER_AUTH_URL differs from container's own view
- admin: add tier limit editor (/admin/tiers) and per-user usage reset
  button, both audit-logged

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/components/recipe/ai-generate-dialog.tsx

@@ -75,7 +75,7 @@ export function AiGenerateDialog({
   const tCommon = useTranslations("common");
   const tRecipe = useTranslations("recipe");
   const router = useRouter();
-  const locale = useLocale();
+  const { locale } = useLocale();
   const [tab, setTab] = useState<Tab>("describe");
 
   // describe tab