fix(auth): disable NextAuth debug mode in production

[MinitJain]

Summary

• `debug: true` was hardcoded unconditionally in `authOptions()`, causing NextAuth to log full JWT contents, session data, and user objects in production
• Changed to `process.env.NODE_ENV !== "production"` so debug logging only activates in development
• Removed three production-path `console.log` statements in `sendVerificationRequest` that logged raw OTP tokens and recipient emails to stdout on every auth request

Changes

1. NextAuth debug flag

```ts

• debug: true,

• debug: process.env.NODE_ENV !== "production",
  ```

2. OTP logging in production email path

Removed from the `RESEND_API_KEY` (production) branch of `sendVerificationRequest`:

• `console.log("sendVerificationRequest")` — unconditional, fires in all environments
• `console.log({ identifier, token })` — logged raw OTP code + recipient email
• `console.log({ email })` — logged rendered OTP email JSX

The dev fallback path (`!RESEND_API_KEY`) is unchanged — OTP codes still print to console in development.

Security Impact

NextAuth debug mode exposes session tokens and OAuth token data in stdout logs. In any hosted deployment, these logs are retained in log aggregation systems (Vercel, Datadog, CloudWatch, etc.), making every session token readable to anyone with log access.

The `console.log({ identifier, token })` statement had the same exposure profile: raw OTP code + user email written to prod stdout on every magic-link auth attempt.

Test plan

• Dev environment: verify OTP codes still appear in console (debug active, dev fallback path intact)
• Production build (`NODE_ENV=production`): verify no JWT/session data in logs
• Production build: verify no OTP tokens or emails in logs from `sendVerificationRequest`

[richiemcilroy]

hey @greptileai please review

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[MinitJain]

@richiemcilroy Typecheck CI is failing but these errors are pre-existing on main and unrelated to this PR.

Verified: the same 4 errors appear in the last CI run on main (run 27854095056, 2026-06-20T00:08):

• apps/desktop/src/routes/editor/context.ts(229) — CaptionsData | null not assignable to EditorCaptionsData | null
• apps/desktop/src/store/captions.ts(242) — CaptionAnimation type mismatch
• apps/web/__tests__/unit/caption-tracks.test.ts(101) — dispatch doesn't exist on HTMLVideoElement
• apps/web/app/(site)/Footer.tsx(4) — missing @fortawesome/fontawesome-svg-core

This PR only modifies packages/database/auth/auth-options.ts. Happy to rebase again once main is green, but the typecheck failure is not caused by these changes.